Memory Leak Vulnerability in thermal: int340x
Summary
GSD-2022-1000725: thermal: int340x: fix memory leak in int3400_notify(). Affects Kernel versions >= 38e44da591303d08b0d965a033e11ade284999d0, < 33c73a4d7e7b19313a6b417152f5365016926418. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thermal package is a component of the Linux Kernel that handles thermal management for various devices. It provides a framework for monitoring and controlling the temperature of different hardware components. The int340x driver within the thermal package specifically handles notifications related to Intel's Integrated Sensor Hub (ISH) devices. These devices are responsible for monitoring and managing thermal and power-related events on Intel-based systems.
Vulnerability Detail
The vulnerability identified in the int340x driver is a memory leak issue in the int3400_notify() function. When certain thermal events occur, the function fails to release allocated memory, leading to a continuous accumulation of memory over time. This can result in resource exhaustion and potential system instability. An attacker with local access to the affected system could potentially exploit this vulnerability to cause a denial-of-service condition or escalate their privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can unload the int340x driver module using the following command:
rmmod int340x
However, this workaround will disable the functionality provided by the int340x driver, which may impact the thermal management capabilities of the system. It is strongly advised to apply the recommended fix by updating the Linux Kernel.
Conclusion
The memory leak vulnerability in the int340x driver of the thermal package can lead to resource exhaustion and system instability. It is crucial to update the Linux Kernel to version v5.16.12 or later to address this issue. Users can also use the Vulert Playground at https://vulert.com/scanner to check if their system is affected and obtain further support for vulnerability remediation.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, potentially causing resource exhaustion and system instability. It may also be exploited by an attacker to trigger a denial-of-service condition or elevate their privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a temporary workaround is to unload the int340x driver module. However, this will disable the functionality provided by the driver, affecting thermal management capabilities. It is recommended to apply the fix by updating the Linux Kernel.
To update the Linux Kernel, you can obtain the latest version from the official Linux Kernel repository or through your Linux distribution's package management system. Follow the documentation or guidelines provided by your distribution for the specific update process.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security updates promptly to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
