Vulnerability in cpufreq: schedutil in Kernel
Summary
GSD-2021-1001601: cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory. Affects Kernel versions >= 67c98e023135ff81b8d52998a6fdb8ca0c518d82, < e2370e1935190054c10d476b5a33fa9e9a18b7e3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cpufreq subsystem in the Linux Kernel is responsible for managing the frequency scaling of CPUs. It provides a framework for dynamically adjusting the CPU frequency based on system load and power management policies. The schedutil governor is a part of cpufreq and is used to make frequency scaling decisions based on CPU utilization. This vulnerability affects the schedutil governor in the cpufreq subsystem.
Vulnerability Detail
The vulnerability in cpufreq: schedutil arises from a race condition where the mutex is not destroyed before the memory is freed by kobject_put(). This can lead to a use-after-free scenario, where an attacker could potentially exploit the freed memory to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the schedutil governor and switch to a different governor, such as the performance governor, which is not affected by this vulnerability. This can be done by modifying the cpufreq configuration or using tools like cpupower.
Conclusion
The vulnerability in cpufreq: schedutil in the Linux Kernel can potentially lead to security issues or a denial-of-service condition. It is recommended to update the Kernel to the fixed version or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The cpufreq subsystem is responsible for managing the frequency scaling of CPUs in the Linux Kernel. It provides a framework for dynamically adjusting the CPU frequency based on system load and power management policies.
The schedutil governor is a part of the cpufreq subsystem in the Linux Kernel. It is responsible for making frequency scaling decisions based on CPU utilization.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including the execution of arbitrary code or a denial-of-service condition.
To fix the vulnerability, it is recommended to update the Linux Kernel to version v5.4.151 or any subsequent version that includes the fix.
Yes, as a workaround, users can disable the schedutil governor and switch to a different governor, such as the performance governor, which is not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
