cve-2021-47393
Vulnerability from cvelistv5
Published
2024-05-21 15:03
Modified
2024-11-04 12:05
Severity ?
Summary
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:20:58.398559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:55.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/mlxreg-fan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c6e0bce647d",
              "status": "affected",
              "version": "65afb4c8e7e4",
              "versionType": "git"
            },
            {
              "lessThan": "a6c42ae1530f",
              "status": "affected",
              "version": "65afb4c8e7e4",
              "versionType": "git"
            },
            {
              "lessThan": "76bbb482d33b",
              "status": "affected",
              "version": "65afb4c8e7e4",
              "versionType": "git"
            },
            {
              "lessThan": "aa85fb7bde55",
              "status": "affected",
              "version": "65afb4c8e7e4",
              "versionType": "git"
            },
            {
              "lessThan": "e6fab7af6ba1",
              "status": "affected",
              "version": "65afb4c8e7e4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/mlxreg-fan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.71",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs\n\nFan speed minimum can be enforced from sysfs. For example, setting\ncurrent fan speed to 20 is used to enforce fan speed to be at 100%\nspeed, 19 - to be not below 90% speed, etcetera. This feature provides\nability to limit fan speed according to some system wise\nconsiderations, like absence of some replaceable units or high system\nambient temperature.\n\nRequest for changing fan minimum speed is configuration request and can\nbe set only through \u0027sysfs\u0027 write procedure. In this situation value of\nargument \u0027state\u0027 is above nominal fan speed maximum.\n\nReturn non-zero code in this case to avoid\nthermal_cooling_device_stats_update() call, because in this case\nstatistics update violates thermal statistics table range.\nThe issues is observed in case kernel is configured with option\nCONFIG_THERMAL_STATISTICS.\n\nHere is the trace from KASAN:\n[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0\n[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444\n[  159.545625] Call Trace:\n[  159.548366]  dump_stack+0x92/0xc1\n[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0\n[  159.635869]  thermal_zone_device_update+0x345/0x780\n[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0\n[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]\n[  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]\n[  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core]\n[  160.070233] RIP: 0033:0x7fd995909970\n[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ..\n[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970\n[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001\n[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700\n[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013\n[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013\n[  160.143671]\n[  160.145338] Allocated by task 2924:\n[  160.149242]  kasan_save_stack+0x19/0x40\n[  160.153541]  __kasan_kmalloc+0x7f/0xa0\n[  160.157743]  __kmalloc+0x1a2/0x2b0\n[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0\n[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500\n[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0\n[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan]\n[  160.248140]\n[  160.249807] The buggy address belongs to the object at ffff888116163400\n[  160.249807]  which belongs to the cache kmalloc-1k of size 1024\n[  160.263814] The buggy address is located 64 bytes to the right of\n[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)\n[  160.277536] The buggy address belongs to the page:\n[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160\n[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0\n[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)\n[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0\n[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000\n[  160.327033] page dumped because: kasan: bad access detected\n[  160.333270]\n[  160.334937] Memory state around the buggy address:\n[  160.356469] \u003effff888116163800: fc .."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:05:03.615Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064"
        }
      ],
      "title": "hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47393",
    "datePublished": "2024-05-21T15:03:50.844Z",
    "dateReserved": "2024-05-21T14:58:30.814Z",
    "dateUpdated": "2024-11-04T12:05:03.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47393\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:24.627\",\"lastModified\":\"2024-05-21T16:54:26.047\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs\\n\\nFan speed minimum can be enforced from sysfs. For example, setting\\ncurrent fan speed to 20 is used to enforce fan speed to be at 100%\\nspeed, 19 - to be not below 90% speed, etcetera. This feature provides\\nability to limit fan speed according to some system wise\\nconsiderations, like absence of some replaceable units or high system\\nambient temperature.\\n\\nRequest for changing fan minimum speed is configuration request and can\\nbe set only through \u0027sysfs\u0027 write procedure. In this situation value of\\nargument \u0027state\u0027 is above nominal fan speed maximum.\\n\\nReturn non-zero code in this case to avoid\\nthermal_cooling_device_stats_update() call, because in this case\\nstatistics update violates thermal statistics table range.\\nThe issues is observed in case kernel is configured with option\\nCONFIG_THERMAL_STATISTICS.\\n\\nHere is the trace from KASAN:\\n[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0\\n[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444\\n[  159.545625] Call Trace:\\n[  159.548366]  dump_stack+0x92/0xc1\\n[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0\\n[  159.635869]  thermal_zone_device_update+0x345/0x780\\n[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0\\n[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]\\n[  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]\\n[  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core]\\n[  160.070233] RIP: 0033:0x7fd995909970\\n[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ..\\n[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\\n[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970\\n[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001\\n[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700\\n[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013\\n[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013\\n[  160.143671]\\n[  160.145338] Allocated by task 2924:\\n[  160.149242]  kasan_save_stack+0x19/0x40\\n[  160.153541]  __kasan_kmalloc+0x7f/0xa0\\n[  160.157743]  __kmalloc+0x1a2/0x2b0\\n[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0\\n[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500\\n[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0\\n[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan]\\n[  160.248140]\\n[  160.249807] The buggy address belongs to the object at ffff888116163400\\n[  160.249807]  which belongs to the cache kmalloc-1k of size 1024\\n[  160.263814] The buggy address is located 64 bytes to the right of\\n[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)\\n[  160.277536] The buggy address belongs to the page:\\n[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160\\n[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0\\n[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)\\n[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0\\n[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000\\n[  160.327033] page dumped because: kasan: bad access detected\\n[  160.333270]\\n[  160.334937] Memory state around the buggy address:\\n[  160.356469] \u003effff888116163800: fc ..\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: hwmon: (mlxreg-fan) Devuelve un valor distinto de cero cuando el estado actual del ventilador se aplica desde sysfs. La velocidad m\u00ednima del ventilador se puede aplicar desde sysfs. Por ejemplo, configurar la velocidad actual del ventilador en 20 se utiliza para hacer que la velocidad del ventilador est\u00e9 al 100 %, 19, para que no est\u00e9 por debajo del 90 %, etc\u00e9tera. Esta caracter\u00edstica brinda la capacidad de limitar la velocidad del ventilador de acuerdo con algunas consideraciones del sistema, como la ausencia de algunas unidades reemplazables o la alta temperatura ambiente del sistema. La solicitud para cambiar la velocidad m\u00ednima del ventilador es una solicitud de configuraci\u00f3n y solo se puede configurar mediante el procedimiento de escritura \u0027sysfs\u0027. En esta situaci\u00f3n, el valor del argumento \\\"estado\\\" est\u00e1 por encima de la velocidad m\u00e1xima nominal del ventilador. En este caso, devuelva un c\u00f3digo distinto de cero para evitar la llamada a Thermal_cooling_device_stats_update(), porque en este caso la actualizaci\u00f3n de estad\u00edsticas viola el rango de la tabla de estad\u00edsticas t\u00e9rmicas. Los problemas se observan en caso de que el kernel est\u00e9 configurado con la opci\u00f3n CONFIG_THERMAL_STATISTICS. Aqu\u00ed est\u00e1 el rastro de KASAN: [159.506659] ERROR: KASAN: slab fuera de los l\u00edmites en Thermal_cooling_device_stats_update+0x7d/0xb0 [159.516016] Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888116163840 mediante la tarea hw-management.s/7444 [ 625] Llamada Seguimiento: [159.548366] dump_stack+0x92/0xc1 [159.552084]? Thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] Thermal_zone_device_update+0x345/0x780 [ 159.688711] Thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f /0x590 [mlxsw_core] [159.700972]? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.07423 9] C\u00f3digo: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff .. [ 160.095242] RSP: 00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 00000000000000013 RSI: 0000000001906008 RDI: 000000000000 0001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 000000246 R12: 00000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Asignado por tarea 2924: [ 160.149242] x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] Thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160. 248140] [160.249807] La direcci\u00f3n con errores pertenece al objeto en ffff888116163400 [160.249807] que pertenece al cach\u00e9 kmalloc-1k de tama\u00f1o 1024 [ 160.263814] La direcci\u00f3n con errores se encuentra 64 bytes a la derecha de [ 160.263814] Regi\u00f3n de 1024 bytes [ffff888116163400, ffff888116163800) [ 160.277536] La direcci\u00f3n con errores pertenece a la p\u00e1gina: [ 160.2 82898] p\u00e1gina:0000000012275840 refcount :1 mapcount:0 mapeo:0000000000000000 \u00edndice:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 orden:3 compuesto_mapcount:0 compuesto_pincount:0 [ 160.303251] banderas: 00000010200(slab|cabeza|nodo=0|zona=2) [ 160.309694 ] sin formato: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] sin formato: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [160.327033] p\u00e1gina volcada porque: kasan: mal acceso detectado [160.333270] [160.334937] Estado de la memoria alrededor de la direcci\u00f3n con errores: [160.356469] \u0026gt;ffff888116163800: fc ..\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/76bbb482d33bfcd7e9070ecf594c9ec73e01c930\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6c42ae1530f94724d3c42cf91fe3d3c5e394f8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa85fb7bde558bb2e364e85976b14b259c8b6fe8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6fab7af6ba1bc77c78713a83876f60ca7a4a064\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.