Vulnerability in cpufreq: schedutil in Linux Kernel
Summary
GSD-2021-1001733: cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory. Affects Kernel versions >= 8d62aec52a8c5b1d25a2364b243fcc5098a2ede9, < e130f2ed1da99309db1e8893a39938ddd7c77312. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The cpufreq subsystem within the Kernel allows for dynamic frequency scaling of the CPU, optimizing power consumption and performance. The schedutil governor is a specific implementation of cpufreq that dynamically adjusts the CPU frequency based on the system's workload. This vulnerability affects the schedutil governor in the cpufreq subsystem.
Vulnerability Detail
The vulnerability in cpufreq: schedutil arises from a race condition where the mutex is not destroyed before the memory is freed by kobject_put(). This can lead to a use-after-free scenario, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v5.14.10 by commit 8d62aec52a8c5b1d25a2364b243fcc5098a2ede9 and is fixed in version v5.14.10 by commit e130f2ed1da99309db1e8893a39938ddd7c77312.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.14.10 or later. This can be done by pulling the latest changes from the official Linux Kernel repository and rebuilding the Kernel. Alternatively, users can wait for their Linux distribution to release an updated package containing the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the schedutil governor and switch to a different governor, such as performance or powersave. This can be done by modifying the CPU frequency scaling configuration in the Kernel or using tools like cpupower. However, switching governors may impact power consumption and performance.
Conclusion
In conclusion, the vulnerability in cpufreq: schedutil in the Linux Kernel can potentially lead to code execution or denial-of-service. It is recommended to update the Kernel to version v5.14.10 or later to fix the vulnerability. Alternatively, users can apply the workaround of switching to a different governor. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could allow an attacker to execute arbitrary code or cause a denial-of-service.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file, such as package-lock.json, without requiring access to the code or installation.
Yes, a patch is available in Linux Kernel version v5.14.10. It is recommended to update to this version or later to fix the vulnerability.
Yes, you can disable the schedutil governor and switch to a different governor, such as performance or powersave. However, this may impact power consumption and performance.
You can refer to the vulnerability details in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001733.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.