Vulnerability in cpufreq: schedutil in Linux Kernel
Summary
GSD-2021-1001536: cpufreq: schedutil: Use kobject release() method to free sugov_tunables. Affects Kernel versions >= 9bdcb44e391da5c41b98573bf0305a0e0b1c9569, < 463c46705f321201090b69c4ad5da0cd2ce614c9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The cpufreq subsystem within the Kernel allows for dynamic frequency scaling of the CPU, optimizing power consumption and performance. The schedutil governor is a part of cpufreq that dynamically adjusts CPU frequency based on the system's workload. This vulnerability specifically affects the schedutil governor's handling of the sugov_tunables structure.
Vulnerability Detail
The vulnerability in cpufreq: schedutil arises from the improper handling of the sugov_tunables structure. The schedutil governor does not correctly free the memory allocated for sugov_tunables, potentially leading to a memory leak. An attacker could exploit this vulnerability to exhaust system memory resources, resulting in a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in cpufreq: schedutil in the Linux Kernel could potentially result in a denial-of-service condition due to a memory leak. It is recommended to update the Kernel to the latest stable version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware.
cpufreq is a subsystem within the Linux Kernel that allows for dynamic frequency scaling of the CPU, optimizing power consumption and performance.
The schedutil governor is a part of cpufreq that dynamically adjusts CPU frequency based on the system's workload.
The impact of this vulnerability is a potential memory leak, which could lead to a denial-of-service condition if system memory resources are exhausted.
To fix this vulnerability, update the Linux Kernel to version v4.14.249 or later, which includes the necessary patch.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
