UBUNTU-CVE-2021-47202: Null Pointer Dereference

Q: Who is realistically exposed to this issue?

Systems running an affected Ubuntu kernel variant that expose device-tree thermal zones are relevant, particularly where a thermal zone consumes a sensor device that has not yet probed. The listed variants include linux, linux-aws, linux-azure, linux-gcp, and their indicated FIPS variants.

Q: What does an attacker or local user need to do to trigger the failure?

A local user needs permission to write a thermal zone trip-point temperature sysfs attribute, such as trip_point_0_temp, while the associated thermal sensor device has not probed. The attempted write can trigger a kernel NULL pointer dereference and denial of service.

Q: Are other thermal sysfs operations implicated?

Yes. The fix also addresses possible NULL pointer dereferences in the paths used to get a temperature, set an emulated temperature, and get a thermal trend.

Published Apr 10, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in ofthermal functions ofparsethermalzones() parses the thermal-zones node and registers a thermalzone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trippointtemp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermalzone87 # echo 120000 > trippoint0temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: ofthermalsettriptemp+0x40/0xc4 trippointtempstore+0xc0/0x1dc devattrstore+0x38/0x88 sysfskfwrite+0x64/0xc0 kernfsfopwriteiter+0x108/0x1d0 vfswrite+0x2f4/0x368 ksyswrite+0x7c/0xec arm64syswrite+0x20/0x30 el0svccommon.llvm.7279915941325364641+0xbc/0x1bc doel0svc+0x28/0xa0 el0svc+0x14/0x24 el0synchandler+0x88/0xec el0sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: ofthermalgettemp(), ofthermalsetemultemp(), ofthermalgettrend().

Affected Software

120 affected componentsFixes available

ubuntu/linux-aws<4.4.0-1156.162

4.4.0-1156.162

ubuntu/linux-azure<4.15.0-1205.220~14.04.1

4.15.0-1205.220~14.04.1

ubuntu/linux-lts-xenial<4.4.0-283.317~14.04.1

4.4.0-283.317~14.04.1

ubuntu/linux<4.4.0-283.317

4.4.0-283.317

ubuntu/linux-aws<4.4.0-1194.209

4.4.0-1194.209

ubuntu/linux-aws-hwe<4.15.0-1194.207~16.04.1

4.15.0-1194.207~16.04.1

ubuntu/linux-azure<4.15.0-1204.219~16.04.1

4.15.0-1204.219~16.04.1

ubuntu/linux-gcp<4.15.0-1187.204~16.04.1

4.15.0-1187.204~16.04.1

ubuntu/linux-hwe<4.15.0-253.265~16.04.1

4.15.0-253.265~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.4.0-1157.168

4.4.0-1157.168

ubuntu/linux-oracle<4.15.0-1156.167~16.04.1

4.15.0-1156.167~16.04.1

ubuntu/linux-fips<4.4.0-1126.133

4.4.0-1126.133

ubuntu/linux-fips*

ubuntu/linux-aws-5.4<5.4.0-1086.93~18.04.1

5.4.0-1086.93~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1094.100~18.04.1

5.4.0-1094.100~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1092.101~18.04.1

5.4.0-1092.101~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-128.144~18.04.1

5.4.0-128.144~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1034.38~18.04.1

5.4.0-1034.38~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1084.92~18.04.1

5.4.0-1084.92~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1071.81~18.04.1

5.4.0-1071.81~18.04.1

ubuntu/linux<4.15.0-253.265

4.15.0-253.265

ubuntu/linux-aws<4.15.0-1194.207

4.15.0-1194.207

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1204.219

4.15.0-1204.219

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1187.204

4.15.0-1187.204

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.15.0-1176.181

4.15.0-1176.181

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1156.167

4.15.0-1156.167

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2132.138

4.15.0-2132.138

ubuntu/linux-azure-fips<4.15.0-2112.118

4.15.0-2112.118

ubuntu/linux-fips<4.15.0-1149.161

4.15.0-1149.161

ubuntu/linux-gcp-fips<4.15.0-2095.101

4.15.0-2095.101

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-128.144

5.4.0-128.144

ubuntu/linux-aws<5.4.0-1086.93

5.4.0-1086.93

ubuntu/linux-azure<5.4.0-1094.100

5.4.0-1094.100

ubuntu/linux-bluefield<5.4.0-1047.52

5.4.0-1047.52

ubuntu/linux-gcp<5.4.0-1090.98

5.4.0-1090.98

ubuntu/linux-gkeop<5.4.0-1054.57

5.4.0-1054.57

ubuntu/linux-ibm<5.4.0-1034.38

5.4.0-1034.38

ubuntu/linux-iot<5.4.0-1005.7

5.4.0-1005.7

ubuntu/linux-kvm<5.4.0-1076.81

5.4.0-1076.81

ubuntu/linux-oracle<5.4.0-1084.92

5.4.0-1084.92

ubuntu/linux-raspi<5.4.0-1071.81

5.4.0-1071.81

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1086.93+fips1

5.4.0-1086.93+fips1

ubuntu/linux-azure-fips<5.4.0-1094.100+fips1

5.4.0-1094.100+fips1

ubuntu/linux-fips<5.4.0-1062.70

5.4.0-1062.70

ubuntu/linux-gcp-fips<5.4.0-1092.101+fips1

5.4.0-1092.101+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1156.162
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1205.220~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-283.317~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-283.317
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1194.209
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.207~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1204.219~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1187.204~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-253.265~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1157.168
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1156.167~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1126.133
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1092.101~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-128.144~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1034.38~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.92~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.81~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-253.265
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.207
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1204.219
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1187.204
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.181
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1156.167
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2132.138
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2112.118
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1149.161
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2095.101
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-128.144
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1047.52
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1090.98
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.57
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1034.38
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1005.7
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.81
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.92
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.81
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1062.70
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1092.101+fips1

Event History

Apr 10, 2024

CVE Published

via OSV·07:15 PM

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems running an affected Ubuntu kernel variant that expose device-tree thermal zones are relevant, particularly where a thermal zone consumes a sensor device that has not yet probed. The listed variants include linux, linux-aws, linux-azure, linux-gcp, and their indicated FIPS variants.

What does an attacker or local user need to do to trigger the failure?

A local user needs permission to write a thermal zone trip-point temperature sysfs attribute, such as trip_point_0_temp, while the associated thermal sensor device has not probed. The attempted write can trigger a kernel NULL pointer dereference and denial of service.

Are other thermal sysfs operations implicated?

Yes. The fix also addresses possible NULL pointer dereferences in the paths used to get a temperature, set an emulated temperature, and get a thermal trend.

UBUNTU-CVE-2021-47202: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker or local user need to do to trigger the failure?

Are other thermal sysfs operations implicated?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker or local user need to do to trigger the failure?

Are other thermal sysfs operations implicated?