发布时间: 2024年5月27日
修改时间: 2024年5月27日
In the Linux kernel, the following vulnerability has been resolved:thermal: core: Fix NULL pointer dereference in zone registration error pathIf device_register() in thermal_zone_device_register_with_trips()returns an error, the tz variable is set to NULL and subsequentlydereferenced in kfree(tz->tzp).Commit adc8749b150c ( thermal/drivers/core: Use put_device() ifdevice_register() fails ) added the tz = NULL assignment in question toavoid a possible double-free after dropping the reference to the zonedevice. However, after commit 4649620d9404 ( thermal: core: Makethermal_zone_device_unregister() return after freeing the zone ), thatassignment has become redundant, because dropping the reference to thezone device does not cause the zone object to be freed any more.Drop it to address the NULL pointer dereference.
| NVD | openEuler | |
|---|---|---|
| CVSS评分 | 5.5 | 2.3 |
| Attack Vector | Local | Local |
| Attack Complexity | Low | Low |
| Privileges Required | Low | High |
| User Interaction | None | None |
| Scope | Unchanged | Unchanged |
| Confidentiality | None | None |
| Integrity | None | None |
| Availability | High | Low |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2024-2245 | In the Linux kernel, the following vulnerability has been resolved:thermal: core: Fix NULL pointer dereference in zone registration error pathIf device_register() in thermal_zone_device_register_with_trips()returns an error, the tz variable is set to NULL and subsequentlydereferenced in kfree(tz->tzp).Commit adc8749b150c ( thermal/drivers/core: Use put_device() ifdevice_register() fails ) added the tz = NULL assignment in question toavoid a possible double-free after dropping the reference to the zonedevice. However, after commit 4649620d9404 ( thermal: core: Makethermal_zone_device_unregister() return after freeing the zone ), thatassignment has become redundant, because dropping the reference to thezone device does not cause the zone object to be freed any more.Drop it to address the NULL pointer dereference. | 2024年5月27日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-4A | kernel | Unaffected |
| KY3.4-5A | kernel | Unaffected |
| KY3.5.1 | kernel | Unaffected |
| KY3.5.2 | kernel | Unaffected |
