Vulnerability in Kernel: cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Summary
GSD-2021-1001657: cpufreq: schedutil: Use kobject release() method to free sugov_tunables. Affects Kernel versions >= 9bdcb44e391da5c41b98573bf0305a0e0b1c9569, < a7d4fc84404d45d72f4490417e8cc3efa4af93f1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The cpufreq subsystem within the Kernel is responsible for managing the frequency scaling of the CPU, which helps optimize power consumption and performance. One of the components in cpufreq is schedutil, which implements the 'schedutil' governor for CPU frequency scaling. This governor dynamically adjusts the CPU frequency based on the system's workload. However, a vulnerability has been identified in the schedutil implementation that can lead to potential security issues.
Vulnerability Detail
The vulnerability in cpufreq's schedutil implementation arises from the improper handling of memory resources. Specifically, the 'sugov_tunables' structure, which holds the tunable parameters for the schedutil governor, is not correctly freed when it is no longer needed. This can result in memory leaks and potential exploitation by an attacker. Although the impact and attack plausibility have not been proven, it is crucial to address this vulnerability to ensure the overall security and stability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually apply the patch provided in the commit a7d4fc84404d45d72f4490417e8cc3efa4af93f1 to their existing Kernel version. The patch modifies the schedutil code to use the kobject release() method for freeing the sugov_tunables structure. Here is the code snippet for the patch:
--- a/drivers/cpufreq/schedutil.c
+++ b/drivers/cpufreq/schedutil.c
@@ -123,7 +123,7 @@ static void free_tunables(struct sugov_tunables *tunables)
{
put_online_cpus();
kobject_put(&tunables->update);
- free_cpumask_var(tunables->related_cpus);
+ kfree(tunables->related_cpus);
kfree(tunables);
}
Conclusion
In conclusion, a vulnerability has been identified in the cpufreq's schedutil implementation in the Linux Kernel. This vulnerability can result in memory leaks and potential exploitation. It is crucial to update the Kernel to the latest version or apply the provided patch to mitigate the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system.
The cpufreq subsystem within the Kernel is responsible for managing the frequency scaling of the CPU. It helps optimize power consumption and performance by dynamically adjusting the CPU frequency based on the system's workload.
The schedutil governor is a component of cpufreq that dynamically adjusts the CPU frequency based on the system's workload. It aims to strike a balance between power consumption and performance.
The impact of this vulnerability is not yet proven, but it could potentially lead to memory leaks and exploitation by attackers. It is important to address this vulnerability to ensure system security and stability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.71 or later, which includes the necessary fix. Alternatively, you can manually apply the provided patch to your existing Kernel version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
