Vulnerability in cpufreq: schedutil in Linux Kernel
Summary
UVI-2021-1001564: cpufreq: schedutil: Use kobject release() method to free sugov_tunables. Affects Kernel versions >= 9bdcb44e391da5c41b98573bf0305a0e0b1c9569, < 30d57cf2c4116ca6d34ecd1cac94ad84f8bc446c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cpufreq package in the Linux Kernel is responsible for managing the frequency scaling of CPUs. It provides a mechanism to dynamically adjust the CPU frequency based on system load, power consumption, and performance requirements. The schedutil governor is a specific component within cpufreq that utilizes the CPU scheduler to make frequency scaling decisions. This vulnerability affects the schedutil governor's handling of the sugov_tunables structure.
Vulnerability Detail
The vulnerability in cpufreq: schedutil arises from the improper handling of the sugov_tunables structure. Specifically, the kobject release() method is not used to free the structure, leading to a potential memory leak. This vulnerability could be exploited by an attacker to exhaust system memory resources, resulting in a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the cpufreq: schedutil vulnerability in the Linux Kernel can potentially lead to a denial-of-service condition by exhausting system memory resources. It is recommended to update the kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Cpufreq is a component in the Linux Kernel that manages the frequency scaling of CPUs. It allows the CPU frequency to be dynamically adjusted based on system load, power consumption, and performance requirements.
The schedutil governor is a specific component within cpufreq that utilizes the CPU scheduler to make frequency scaling decisions. It aims to optimize performance and power consumption by dynamically adjusting the CPU frequency.
The sugov_tunables structure is a data structure used by the schedutil governor to store tunable parameters related to frequency scaling decisions. It is improperly handled in the vulnerable code, leading to a potential memory leak.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could result in a denial-of-service condition by exhausting system memory resources.
To fix this vulnerability, update the Linux Kernel to version v4.19.209 or later, which includes the necessary fix. Ensure that the kobject release() method is used to free the sugov_tunables structure.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
