CVE-2024-36961

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thermal/debugfs: Fix two locking issues with thermal zone debug

With the current thermal zone locking arrangement in the debugfs code,

user space can open the "mitigations" file for a thermal zone before

the zone's debugfs pointer is set which will result in a NULL pointer

dereference in tze_seq_start().

Moreover, thermal_debug_tz_remove() is not called under the thermal

zone lock, so it can run in parallel with the other functions accessing

the thermal zone's struct thermal_debugfs object. Then, it may clear

tz->debugfs after one of those functions has checked it and the

struct thermal_debugfs object may be freed prematurely.

To address the first problem, pass a pointer to the thermal zone's

struct thermal_debugfs object to debugfs_create_file() in

thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(),

tze_seq_stop(), and tze_seq_show() retrieve it from s->private

instead of a pointer to the thermal zon

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References