Vulnerability in Kernel (Linux): hwmon (mlxreg-fan)
Summary
GSD-2021-1001725: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs. Affects Kernel versions >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6, < aa85fb7bde558bb2e364e85976b14b259c8b6fe8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. One of the components within the Kernel is hwmon, which is responsible for monitoring and controlling hardware devices. The mlxreg-fan module is a part of hwmon and specifically handles fan-related operations. It allows users to interact with fan settings through the sysfs interface.
Vulnerability Detail
The vulnerability in hwmon (mlxreg-fan) allows an attacker to enforce a fan's current state from the sysfs interface and return a non-zero value. This issue can potentially be exploited to manipulate fan behavior, leading to adverse effects such as overheating or system instability. The vulnerability was introduced in version v4.19 of the Linux Kernel and has been fixed in version v5.14.10.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.14.10 or later. This update includes the necessary patch to address the issue. Users can obtain the updated Kernel from the official Linux Kernel repository. Detailed instructions on how to update the Kernel can be found in the documentation provided by the Linux distribution being used.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the sysfs interface for fan control to mitigate the risk of exploitation. This can be achieved by modifying the system configuration or removing the mlxreg-fan module. However, it is important to note that this workaround may limit the functionality of fan control and should only be considered until the Kernel update can be applied.
Conclusion
The vulnerability in hwmon (mlxreg-fan) within the Linux Kernel can allow an attacker to manipulate fan behavior, potentially leading to overheating and system instability. It is crucial to update the Kernel to version v5.14.10 or later to mitigate this vulnerability. As a temporary workaround, users can disable the sysfs interface for fan control. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows an attacker to manipulate fan behavior, which can result in overheating or system instability. It poses a potential risk to the overall system performance and reliability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fix to ensure the system's security and stability.
Yes, you can temporarily disable the sysfs interface for fan control as a mitigation measure. However, it is strongly advised to update the Kernel to the latest version as soon as possible to fully address the vulnerability.
For more details about this vulnerability, including technical specifics and the fix implementation, you can refer to the official Linux Kernel repository and the associated commit history.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.