Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Check for null before removing sysfs attrs If coretemp_add_core() gets an error then pdata->core_data[indx] is already NULL and has been kfreed. Don't pass that to sysfs_remove_group() as that will crash in sysfs_remove_group(). [Shortened for readability] [91854.020159] sysfs: cannot create duplicate filename '/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label' <cpu offline> [91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188 [91855.165103] #PF: supervisor read access in kernel mode [91855.194506] #PF: error_code(0x0000) - not-present page [91855.224445] PGD 0 P4D 0 [91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI ... [91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80 ... [91855.796571] Call Trace: [91855.810524] coretemp_cpu_offline+0x12b/0x1dd [coretemp] [91855.841738] ? coretemp_cpu_online+0x180/0x180 [coretemp] [91855.871107] cpuhp_invoke_callback+0x105/0x4b0 [91855.893432] cpuhp_thread_fun+0x8e/0x150 ... Fix this by checking for NULL first.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
199e0de7f5df31a4fc485d4aaaf8a07718252ace to < fb503d077ff7b43913503eaf72995d1239028b99affected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < 070d5ea4a0592a37ad96ce7f7b6b024f90bb009faffected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < 280110db1a7d62ad635b103bafc3ae96e8bef75caffected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < 89eecabe6a47403237f45aafd7d24f93cb973653affected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < f06e0cd01eab954bd5f2190c9faa79bb5357e05baffected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < 7692700ac818866d138a8de555130a6e70e6ac16affected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < ae6c8b6e5d5628df1c475c0a8fca1465e205c95baffected199e0de7f5df31a4fc485d4aaaf8a07718252ace to < a89ff5f5cc64b9fe7a992cf56988fd36f56ca82aaffected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected4.9.335 to ≤ 4.9.*unaffected4.14.301 to ≤ 4.14.*unaffected4.19.268 to ≤ 4.19.*unaffected5.4.226 to ≤ 5.4.*unaffected5.10.158 to ≤ 5.10.*unaffected5.15.82 to ≤ 5.15.*unaffected6.0.12 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fb503d077ff7b43913503eaf72995d1239028b99 ↗
- https://git.kernel.org/stable/c/070d5ea4a0592a37ad96ce7f7b6b024f90bb009f ↗
- https://git.kernel.org/stable/c/280110db1a7d62ad635b103bafc3ae96e8bef75c ↗
- https://git.kernel.org/stable/c/89eecabe6a47403237f45aafd7d24f93cb973653 ↗
- https://git.kernel.org/stable/c/f06e0cd01eab954bd5f2190c9faa79bb5357e05b ↗
- https://git.kernel.org/stable/c/7692700ac818866d138a8de555130a6e70e6ac16 ↗
- https://git.kernel.org/stable/c/ae6c8b6e5d5628df1c475c0a8fca1465e205c95b ↗
- https://git.kernel.org/stable/c/a89ff5f5cc64b9fe7a992cf56988fd36f56ca82a ↗