Vulnerability in Kernel package: hwmon (mlxreg-fan)
Summary
GSD-2021-1001562: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs. Affects Kernel versions >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6, < 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to interact with the underlying hardware. The hwmon subsystem within the Kernel package is specifically designed to monitor and control various hardware devices, including fans. The mlxreg-fan driver is part of this subsystem and is responsible for managing fan operations. This vulnerability affects the mlxreg-fan driver when enforcing the fan's current state from sysfs.
Vulnerability Detail
The vulnerability in the mlxreg-fan driver allows an attacker to manipulate the fan's current state through sysfs, resulting in a non-zero value being returned. This could potentially lead to unauthorized control over the fan's speed or other fan-related operations. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.19.209 by commit 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca. The vulnerability was introduced in version v4.19 by commit 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Kernel package's hwmon (mlxreg-fan) driver allows for potential unauthorized control over fan operations. It is crucial to update the Linux Kernel package to version v4.19.209 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to manipulate the fan's current state and gain unauthorized control over fan operations.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file, such as package-lock.json, without requiring access to the code or installation.
Yes, the vulnerability has been fixed in Linux Kernel version v4.19.209 by commit 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca. It is recommended to update the Kernel package to this version or later.
You can update the Linux Kernel package by following the official update process provided by your Linux distribution. Alternatively, you can manually compile and install the updated Kernel version from the source code.
You can find more information about this vulnerability in the GSD-2021-1001562 JSON report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001562.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
