cbcvebase.
CVE-2021-47393
published 2024-05-21

CVE-2021-47393: In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan…

PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS. Here is the trace from KASAN: [ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 R

Affected

16 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.14.12-1 (bookworm)linux 5.14.12-1 (bookworm)
linuxlinux
linuxlinux>= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca
linuxlinux>= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < a6c42ae1530f94724d3c42cf91fe3d3c5e394f8aa6c42ae1530f94724d3c42cf91fe3d3c5e394f8a
linuxlinux>= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < 76bbb482d33bfcd7e9070ecf594c9ec73e01c93076bbb482d33bfcd7e9070ecf594c9ec73e01c930
linuxlinux>= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < aa85fb7bde558bb2e364e85976b14b259c8b6fe8aa85fb7bde558bb2e364e85976b14b259c8b6fe8
linuxlinux>= 65afb4c8e7e4e7e74b28efa1df62da503ca3e7a6 < e6fab7af6ba1bc77c78713a83876f60ca7a4a064e6fab7af6ba1bc77c78713a83876f60ca7a4a064
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.84-15.10.84-1
linuxlinux_kernel>= 0 < 5.14.12-15.14.12-1
linuxlinux_kernel>= 0 < 5.14.12-15.14.12-1
linuxlinux_kernel>= 0 < 5.14.12-15.14.12-1
linuxlinux_kernel>= 4.19 < 4.19.2094.19.209
linuxlinux_kernel>= 4.20 < 5.4.1515.4.151
linuxlinux_kernel>= 5.11 < 5.14.105.14.10
linuxlinux_kernel>= 5.5 < 5.10.715.10.71

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.