Description
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone governor cleanup issues If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < a172fa18bc370b776ac1510abb0dcb50a7a35facaffectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < 8e563d8db50f303171aceb79eec0807e7ba06951affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < d4eb861adde5ce22e459fbd29366f47bb2167977affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < 37a430a2d4e66ec8238da6c7f7e48809bf265e13affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < f412e541d25a3dfaf3d53e012ade6ff03cae8a45affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < 75f8f3c3e09122270986de9d7aa347d701676761affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < 64d4ebf91d082034bbc5ae3ba2d7fd800bc02d06affectede33df1d2f3a0141cd79e770f31999ba0dd7ebfa8 to < 41ff66baf81c6541f4f985dd7eac4494d03d9440affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a172fa18bc370b776ac1510abb0dcb50a7a35fac ↗
- https://git.kernel.org/stable/c/8e563d8db50f303171aceb79eec0807e7ba06951 ↗
- https://git.kernel.org/stable/c/d4eb861adde5ce22e459fbd29366f47bb2167977 ↗
- https://git.kernel.org/stable/c/37a430a2d4e66ec8238da6c7f7e48809bf265e13 ↗
- https://git.kernel.org/stable/c/f412e541d25a3dfaf3d53e012ade6ff03cae8a45 ↗
- https://git.kernel.org/stable/c/75f8f3c3e09122270986de9d7aa347d701676761 ↗
- https://git.kernel.org/stable/c/64d4ebf91d082034bbc5ae3ba2d7fd800bc02d06 ↗
- https://git.kernel.org/stable/c/41ff66baf81c6541f4f985dd7eac4494d03d9440 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗