CVE-2024-36961 thermal/debugfs: Fix two locking issues with thermal zone debug
A race condition in the Linux kernel thermal debugfs code allows a local attacker to trigger a NULL pointer dereference, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36961?
CVE-2024-36961 is a high-severity vulnerability in Linux kernel, published on 3 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thermal/debugfs: Fix two locking issues with thermal zone debug
With the current thermal zone locking arrangement in the debugfs code, user space can open the "mitigations" file for a thermal zone before the zone's debugfs pointer is set which will result in a NULL pointer dereference in tze_seq_start().
Moreover, thermal_debug_tz_remove() is not called under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct thermal_debugfs object. Then, it may clear tz->debugfs after one of those functions has checked it and the struct thermal_debugfs object may be freed prematurely.
To address the first problem, pass a pointer to the thermal zone's struct thermal_debugfs object to debugfs_create_file() in thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(), tze_seq_stop(), and tze_seq_show() retrieve it from s->private instead of a pointer to the thermal zone object. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_id() called by thermal_debug_tz_remove() removes that file.
To address the second problem, use tz->lock in thermal_debug_tz_remove() around the tz->debugfs value check (in case the same thermal zone is removed at the same time in two different threads) and its reset to NULL.
Cc :6.8+ <[email protected]> # 6.8+
Weakness: CWE-667
Which versions are affected by CVE-2024-36961?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-36961?
Apply the vendor's patch.
Is CVE-2024-36961 being exploited?
There is no known exploitation of CVE-2024-36961 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-36961, DEBIAN-CVE-2024-36961, GHSA-rcqf-hc64-m737, UBUNTU-CVE-2024-36961.