Offset Overflow Issue in Index Converting in tools/power turbostat
Summary
UVI-2021-1000132: tools/power turbostat: Fix offset overflow issue in index converting. Affects Kernel versions >= 9972d5d84d76982606806b2ce887f70c2f8ba60a, < ea6803ff2cd1a2d7d880256bf562172b708a76ff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'tools/power turbostat' is a tool in the Linux Kernel package that provides information about processor topology, frequency, idle power-state statistics, and temperature. It is commonly used for monitoring and analyzing CPU performance. However, a vulnerability has been discovered in the index converting process of this tool, which can lead to an offset overflow issue.
Vulnerability Detail
The vulnerability in 'tools/power turbostat' arises from an offset overflow issue during index converting. This issue can be exploited by an attacker to manipulate memory addresses and potentially execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v5.10 of the Linux Kernel and was fixed in version v5.10.36 by commit ea6803ff2cd1a2d7d880256bf562172b708a76ff.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by disabling or restricting access to the 'tools/power turbostat' tool. This can be done by removing execute permissions for the tool or by restricting user privileges to prevent its execution.
Conclusion
The offset overflow issue in the index converting process of 'tools/power turbostat' in the Linux Kernel package can pose a security risk, allowing potential memory manipulation and unauthorized code execution. It is crucial to update the Linux Kernel to version v5.10.36 or later to mitigate this vulnerability. If immediate updating is not possible, implementing a temporary workaround by restricting access to the affected tool can help mitigate the risk. For further support and guidance, contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on systems running the affected version of the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
No, this vulnerability requires local access to the system in order to exploit it. However, it is still crucial to address the vulnerability to prevent any potential local attacks.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. They can provide guidance and recommendations specific to your environment.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
