CVE-2024-36956 thermal/debugfs: Free all thermal zone debug memory on zone removal

2024-05-3015:35:49

Linux

github.com

linux kernel

vulnerability

fix

thermal

debugfs

memory leak

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

thermal/debugfs: Free all thermal zone debug memory on zone removal

Because thermal_debug_tz_remove() does not free all memory allocated for
thermal zone diagnostics, some of that memory becomes unreachable after
freeing the thermal zone’s struct thermal_debugfs object.

Address this by making thermal_debug_tz_remove() free all of the memory
in question.

Cc :6.8+ <[email protected]> # 6.8+

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "7ef01f228c9f",
        "lessThan": "f51564e4b399",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "7ef01f228c9f",
        "lessThan": "72c1afffa4c6",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/thermal/thermal_debugfs.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.8",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "6.8.10",
        "versionType": "custom",
        "lessThanOrEqual": "6.8.*"
      },
      {
        "status": "unaffected",
        "version": "6.9",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/thermal/thermal_debugfs.c"
    ],
    "defaultStatus": "affected"
  }
]