Out-of-Bounds Memory Access in mlxsw Thermal
Summary
UVI-2021-1001903: mlxsw: thermal: Fix out-of-bounds memory accesses. Affects Kernel versions >= a50c1e35650b929500bd89be61c89d95a267ce56, < df8e58716afb3bee2b59de66b1ba1033f2e26303. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mlxsw package is a component of the Linux Kernel ecosystem. It provides support for Mellanox Spectrum switches. The mlxsw_thermal module within the package is responsible for managing the thermal aspects of these switches. It monitors the temperature of various components and takes appropriate actions to prevent overheating. However, a vulnerability has been discovered in the mlxsw_thermal module that allows for out-of-bounds memory accesses.
Vulnerability Detail
The vulnerability in mlxsw_thermal arises from improper memory access operations. It can be exploited by an attacker to read or write data outside the boundaries of allocated memory. This can lead to various consequences, including information disclosure, privilege escalation, or even system crashes. The vulnerability was introduced in version 4.10 of the Linux Kernel and has been fixed in version 5.14.14.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the mlxsw_thermal module if it is not essential for their system's operation. This can be achieved by blacklisting the module or preventing it from loading during system startup. However, this workaround may result in the loss of thermal management capabilities for Mellanox Spectrum switches.
Conclusion
The vulnerability in mlxsw_thermal module can have serious security implications, including information disclosure and privilege escalation. It is crucial to update the Linux Kernel to the fixed version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mlxsw is a package within the Linux Kernel ecosystem that provides support for Mellanox Spectrum switches.
mlxsw_thermal is a module within the mlxsw package that handles thermal management for Mellanox Spectrum switches.
The vulnerability can lead to information disclosure, privilege escalation, or system crashes.
Update the Linux Kernel to version 5.14.14 or later.
Yes, users can disable the mlxsw_thermal module if it is not necessary for their system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
