CVE-2021-47393
published 2024-05-21CVE-2021-47393: In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan…
PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Fan speed minimum can be enforced from sysfs. For example, setting
current fan speed to 20 is used to enforce fan speed to be at 100%
speed, 19 - to be not below 90% speed, etcetera. This feature provides
ability to limit fan speed according to some system wise
considerations, like absence of some replaceable units or high system
ambient temperature.
Request for changing fan minimum speed is configuration request and can
be set only through 'sysfs' write procedure. In this situation value of
argument 'state' is above nominal fan speed maximum.
Return non-zero code in this case to avoid
thermal_cooling_device_stats_update() call, because in this case
statistics update violates thermal statistics table range.
The issues is observed in case kernel is configured with option
CONFIG_THERMAL_STATISTICS.
Here is the trace from KASAN:
[ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0
[ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444
[ 159.545625] Call Trace:
[ 159.548366] dump_stack+0x92/0xc1
[ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0
[ 159.635869] thermal_zone_device_update+0x345/0x780
[ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0
[ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]
[ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]
[ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core]
[ 160.070233] RIP: 0033:0x7fd995909970
[ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 3d 01 f0 ff ..
[ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970
[ 160.111710] RDX: 0000000000000013 R
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.12-1 (bookworm) | linux 5.14.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca | 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca |
| linux | linux | >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a | a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a |
| linux | linux | >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < 76bbb482d33bfcd7e9070ecf594c9ec73e01c930 | 76bbb482d33bfcd7e9070ecf594c9ec73e01c930 |
| linux | linux | >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < aa85fb7bde558bb2e364e85976b14b259c8b6fe8 | aa85fb7bde558bb2e364e85976b14b259c8b6fe8 |
| linux | linux | >= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < e6fab7af6ba1bc77c78713a83876f60ca7a4a064 | e6fab7af6ba1bc77c78713a83876f60ca7a4a064 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 0 < 5.14.12-1 | 5.14.12-1 |
| linux | linux_kernel | >= 4.19 < 4.19.209 | 4.19.209 |
| linux | linux_kernel | >= 4.20 < 5.4.151 | 5.4.151 |
| linux | linux_kernel | >= 5.11 < 5.14.10 | 5.14.10 |
| linux | linux_kernel | >= 5.5 < 5.10.71 | 5.10.71 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7f2x-rjqg-7667: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from
ghsa_unreviewed·2024-05-21
CVE-2021-47393 [HIGH] CWE-125 GHSA-7f2x-rjqg-7667: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Fan speed minimum can be enforced from sysfs. For example, setting
current fan speed to 20 is used to enforce fan speed to be at 100%
speed, 19 - to be not below 90% speed, etcetera. This feature provides
ability to limit fan speed according to some system wise
considerations, like absence of some replaceable units or high system
ambient temperature.
Request for changing fan minimum speed is configuration request and can
be set only through 'sysfs' write procedure. In this situation value of
argument 'state' is above nominal fan speed maximum.
Return non-zero code in this case to avoid
thermal_cooling_device_stats_update() call, bec
OSV
CVE-2021-47393: In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from
osv·2024-05-21·CVSS 7.1
CVE-2021-47393 [HIGH] CVE-2021-47393: In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from
In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because
Red Hat
kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
vendor_redhat·2024-05-21·CVSS 7.1
CVE-2021-47393 [HIGH] CWE-754 kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Fan speed minimum can be enforced from sysfs. For example, setting
current fan speed to 20 is used to enforce fan speed to be at 100%
speed, 19 - to be not below 90% speed, etcetera. This feature provides
ability to limit fan speed according to some system wise
considerations, like absence of some replaceable units or high system
ambient temperature.
Request for changing fan minimum speed is configuration request and can
be set only through 'sysfs' write procedure. In this situation value of
argument 'state' is above nominal fan speed maximu
Debian
CVE-2021-47393: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlx...
vendor_debian·2021·CVSS 7.1
CVE-2021-47393 [HIGH] CVE-2021-47393: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlx...
In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6cahttps://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8ahttps://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6cahttps://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8ahttps://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064
2024-05-21
Published