Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-36961— thermal/debugfs: Fix two locking issues with thermal zone debug

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 thermal/debugfs 中存在锁定问题。

CVSS 7.8 · High EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 7ef01f228c9f54c6260319858be138a8a7e9e704< 6c57bdd0505422d5ccd2df541d993aec978c842e affected
7ef01f228c9f54c6260319858be138a8a7e9e704< c7f7c37271787a7f77d7eedc132b0b419a76b4c8 affected
6.8 affected
< 6.8 unaffected
6.8.10≤ 6.8.* unaffected
6.9≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-36961

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
thermal/debugfs: Fix two locking issues with thermal zone debug
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Fix two locking issues with thermal zone debug With the current thermal zone locking arrangement in the debugfs code, user space can open the "mitigations" file for a thermal zone before the zone's debugfs pointer is set which will result in a NULL pointer dereference in tze_seq_start(). Moreover, thermal_debug_tz_remove() is not called under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct thermal_debugfs object. Then, it may clear tz->debugfs after one of those functions has checked it and the struct thermal_debugfs object may be freed prematurely. To address the first problem, pass a pointer to the thermal zone's struct thermal_debugfs object to debugfs_create_file() in thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(), tze_seq_stop(), and tze_seq_show() retrieve it from s->private instead of a pointer to the thermal zone object. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_id() called by thermal_debug_tz_remove() removes that file. To address the second problem, use tz->lock in thermal_debug_tz_remove() around the tz->debugfs value check (in case the same thermal zone is removed at the same time in two different threads) and its reset to NULL. Cc :6.8+ <stable@vger.kernel.org> # 6.8+
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 thermal/debugfs 中存在锁定问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7ef01f228c9f54c6260319858be138a8a7e9e704 ~ 6c57bdd0505422d5ccd2df541d993aec978c842e -
Linux Linux 6.8 -

II. Public POCs for CVE-2024-36961

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-36961

请登录查看更多情报信息。

Other References for CVE-2024-36961 (2)

Same Patch Batch · Linux · 2024-06-03 · 5 CVEs total

CVE-2024-36964 8.8 HIGH fs/9p: only translate RWX permissions for plain 9P2000
CVE-2024-36963 7.8 HIGH tracefs: Reset permissions on remount if permissions are options
CVE-2024-36962 7.5 HIGH net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
CVE-2024-36960 7.1 HIGH drm/vmwgfx: Fix invalid reads in fence signaled events

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-36961

No comments yet

Leave a comment