CVE-2021-47441

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: thermal: Fix out-of-bounds memory accesses

Currently, mlxsw allows cooling states to be set above the maximum

cooling state supported by the driver:

# cat /sys/class/thermal/thermal_zone2/cdev0/type

mlxsw_fan

# cat /sys/class/thermal/thermal_zone2/cdev0/max_state

10

# echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state

# echo $?

0

This results in out-of-bounds memory accesses when thermal state

transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the

transition table is accessed with a too large index (state) [1].

According to the thermal maintainer, it is the responsibility of the

driver to reject such operations [2].

Therefore, return an error when the state to be set exceeds the maximum

cooling state supported by the driver.

To avoid dead code, as suggested by the thermal maintainer [3],

partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling

device with cooling

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References