UBUNTU-CVE-2021-47202
In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in of_thermal_ functions of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec __arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend().
02 / AFFECTED SOFTWARE
Affected packages
12 explicit affected versions
6 explicit affected versions
57 explicit affected versions
50 explicit affected versions
6 explicit affected versions
26 explicit affected versions
191 explicit affected versions
7 explicit affected versions
52 explicit affected versions
83 explicit affected versions
35 explicit affected versions
18 explicit affected versions
116 explicit affected versions
13 explicit affected versions
4 explicit affected versions
120 explicit affected versions
23 explicit affected versions
1 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
10 explicit affected versions
7 explicit affected versions
12 explicit affected versions
109 explicit affected versions
12 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
57 explicit affected versions
16 explicit affected versions
65 explicit affected versions
12 explicit affected versions
55 explicit affected versions
119 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
1 explicit affected versions
2 explicit affected versions
26 explicit affected versions
13 explicit affected versions
143 explicit affected versions
1 explicit affected versions
29 explicit affected versions
13 explicit affected versions
1 explicit affected versions
57 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
187 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
55 explicit affected versions
136 explicit affected versions
2 explicit affected versions
129 explicit affected versions
164 explicit affected versions
151 explicit affected versions
53 explicit affected versions
10 explicit affected versions
26 explicit affected versions
13 explicit affected versions
136 explicit affected versions
16 explicit affected versions
113 explicit affected versions
3 explicit affected versions
91 explicit affected versions
1 explicit affected versions
23 explicit affected versions
51 explicit affected versions
90 explicit affected versions
12 explicit affected versions
27 explicit affected versions
1 explicit affected versions
1 explicit affected versions
95 explicit affected versions
8 explicit affected versions
5 explicit affected versions
47 explicit affected versions
8 explicit affected versions
1 explicit affected versions
44 explicit affected versions
10 explicit affected versions
13 explicit affected versions
12 explicit affected versions
7 explicit affected versions
138 explicit affected versions
91 explicit affected versions
10 explicit affected versions
12 explicit affected versions
41 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
37 explicit affected versions
38 explicit affected versions
164 explicit affected versions
9 explicit affected versions
11 explicit affected versions
45 explicit affected versions
7 explicit affected versions
96 explicit affected versions
22 explicit affected versions
120 explicit affected versions
4 explicit affected versions
45 explicit affected versions
43 explicit affected versions
12 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
45 explicit affected versions
4 explicit affected versions
34 explicit affected versions
1 explicit affected versions
67 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in of_thermal_ functions of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec __arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend().
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/96cfe05051fd8543cdedd6807ec59a0e6c409195
- https://git.kernel.org/stable/c/0750f769b95841b34a9fe8c418dd792ff526bf86
- https://git.kernel.org/stable/c/6a315471cb6a07f651e1d3adc8962730f4fcccac
- https://git.kernel.org/stable/c/828f4c31684da94ecf0b44a2cbd35bbede04f0bd
- https://git.kernel.org/stable/c/96cfe05051fd8543cdedd6807ec59a0e6c409195
- https://git.kernel.org/stable/c/ef2590a5305e0b8e9342f84c2214aa478ee7f28e
- https://ubuntu.com/security/CVE-2021-47202
- https://ubuntu.com/security/notices/USN-8529-1
- https://ubuntu.com/security/notices/USN-8529-2
- https://ubuntu.com/security/notices/USN-8530-1
- https://ubuntu.com/security/notices/USN-8530-2
- https://ubuntu.com/security/notices/USN-8548-1
- https://ubuntu.com/security/notices/USN-8548-2
- https://ubuntu.com/security/notices/USN-8635-1
- https://www.cve.org/CVERecord?id=CVE-2021-47202