Vulnerability in Kernel: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference
Summary
GSD-2022-1000837: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference. Affects Kernel versions >= 1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00, < 1c0b51e62a50e9291764d022ed44549e65d6ab9c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. One of the components within the Kernel is the thermal subsystem, which manages temperature-related aspects of the system. This vulnerability specifically affects the thermal core module of the Kernel.
Vulnerability Detail
The vulnerability identified in the thermal core module of the Kernel is related to a NULL pointer dereference issue in the TZ_GET_TRIP function. This vulnerability could be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The issue arises when the TZ_GET_TRIP function is called with an invalid thermal zone, leading to a NULL pointer dereference. This vulnerability was introduced in version v5.9 of the Linux Kernel and has been fixed in version v5.10.104.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the thermal subsystem or unload the thermal module to mitigate the risk associated with this vulnerability. However, this may impact the system's ability to manage temperature-related aspects effectively. The following commands can be used to disable the thermal subsystem:
-
Disable thermal subsystem: $ sudo rmmod thermal
-
Unload thermal module: $ sudo modprobe -r thermal
Conclusion
In conclusion, the vulnerability in the thermal core module of the Kernel can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. It is crucial to update the Linux Kernel to version v5.10.104 or later to mitigate this vulnerability. Users can also consider using tools like Vulert to monitor and alert for open-source vulnerabilities in their software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code with kernel privileges.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Yes, a patch for this vulnerability has been released in version v5.10.104 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
Yes, as a temporary workaround, you can disable the thermal subsystem or unload the thermal module. However, this may impact the system's ability to manage temperature-related aspects effectively.
You can refer to the vulnerability details provided by the Cloud Security Alliance's GSD database. The vulnerability ID is GSD-2022-1000837.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
