[{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"a50c1e35650b","lessThan":"ae0993739e14","versionType":"custom","status":"affected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"4.10","status":"affected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"4.10","versionType":"custom","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.155","lessThanOrEqual":"5.5","versionType":"custom","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"5.10.75","lessThanOrEqual":"5.11","versionType":"custom","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"5.14.14","lessThanOrEqual":"5.15","versionType":"custom","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"5.15","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"},{"version":"a50c1e35650b","lessThan":"e59d839743b5","versionType":"custom","status":"affected"},{"version":"a50c1e35650b","lessThan":"df8e58716afb","versionType":"custom","status":"affected"},{"version":"a50c1e35650b","lessThan":"332fdf951df8","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-05-22T15:01:53.700681Z","id":"CVE-2021-47441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlxsw/core_thermal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a50c1e35650b929500bd89be61c89d95a267ce56","lessThan":"ae0993739e14a102d506aa09e11b0065f3144f10","versionType":"git","status":"affected"},{"version":"a50c1e35650b929500bd89be61c89d95a267ce56","lessThan":"e59d839743b50cb1d3f42a786bea48cc5621d254","versionType":"git","status":"affected"},{"version":"a50c1e35650b929500bd89be61c89d95a267ce56","lessThan":"df8e58716afb3bee2b59de66b1ba1033f2e26303","versionType":"git","status":"affected"},{"version":"a50c1e35650b929500bd89be61c89d95a267ce56","lessThan":"332fdf951df8b870e3da86b122ae304e2aabe88c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlxsw/core_thermal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.4.155","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"5.10.75","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.14.14","lessThanOrEqual":"5.14.*","versionType":"semver","status":"unaffected"},{"version":"5.15","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

OR
          *cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.14.14
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 5.4.155
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.75

CVE: https://git.kernel.org/stable/c/332fdf951df8b870e3da86b122ae304e2aabe88c Types: Patch

CVE: https://git.kernel.org/stable/c/ae0993739e14a102d506aa09e11b0065f3144f10 Types: Patch

CVE: https://git.kernel.org/stable/c/df8e58716afb3bee2b59de66b1ba1033f2e26303 Types: Patch

CVE: https://git.kernel.org/stable/c/e59d839743b50cb1d3f42a786bea48cc5621d254 Types: Patch

kernel.org: https://git.kernel.org/stable/c/332fdf951df8b870e3da86b122ae304e2aabe88c Types: Patch

kernel.org: https://git.kernel.org/stable/c/ae0993739e14a102d506aa09e11b0065f3144f10 Types: Patch

kernel.org: https://git.kernel.org/stable/c/df8e58716afb3bee2b59de66b1ba1033f2e26303 Types: Patch

kernel.org: https://git.kernel.org/stable/c/e59d839743b50cb1d3f42a786bea48cc5621d254 Types: Patch

https://git.kernel.org/stable/c/332fdf951df8b870e3da86b122ae304e2aabe88c

https://git.kernel.org/stable/c/ae0993739e14a102d506aa09e11b0065f3144f10

https://git.kernel.org/stable/c/df8e58716afb3bee2b59de66b1ba1033f2e26303

https://git.kernel.org/stable/c/e59d839743b50cb1d3f42a786bea48cc5621d254

CISA-ADP AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CISA-ADP CWE-787

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: thermal: Fix out-of-bounds memory accesses

Currently, mlxsw allows cooling states to be set above the maximum
cooling state supported by the driver:

 # cat /sys/class/thermal/thermal_zone2/cdev0/type
 mlxsw_fan
 # cat /sys/class/thermal/thermal_zone2/cdev0/max_state
 10
 # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state
 # echo $?
 0

This results in out-of-bounds memory accesses when thermal state
transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the
transition table is accessed with a too large index (state) [1].

According to the thermal maintainer, it is the responsibility of the
driver to reject such operations [2].

Therefore, return an error when the state to be set exceeds the maximum
cooling state supported by the driver.

To avoid dead code, as suggested by the thermal maintainer [3],
partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling
device with cooling levels") that tried to interpret these invalid
cooling states (above the maximum) in a special way. The cooling levels
array is not removed in order to prevent the fans going below 20% PWM,
which would cause them to get stuck at 0% PWM.

[1]
BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290
Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122
Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016
Workqueue: events_freezable_power_ thermal_zone_device_check
Call Trace:
 dump_stack_lvl+0x8b/0xb3
 print_address_description.constprop.0+0x1f/0x140
 kasan_report.cold+0x7f/0x11b
 thermal_cooling_device_stats_update+0x271/0x290
 __thermal_cdev_update+0x15e/0x4e0
 thermal_cdev_update+0x9f/0xe0
 step_wise_throttle+0x770/0xee0
 thermal_zone_device_update+0x3f6/0xdf0
 process_one_work+0xa42/0x1770
 worker_thread+0x62f/0x13e0
 kthread+0x3ee/0x4e0
 ret_from_fork+0x1f/0x30

Allocated 

kernel.org https://git.kernel.org/stable/c/332fdf951df8b870e3da86b122ae304e2aabe88c [No types assigned]

kernel.org https://git.kernel.org/stable/c/ae0993739e14a102d506aa09e11b0065f3144f10 [No types assigned]

kernel.org https://git.kernel.org/stable/c/df8e58716afb3bee2b59de66b1ba1033f2e26303 [No types assigned]

kernel.org https://git.kernel.org/stable/c/e59d839743b50cb1d3f42a786bea48cc5621d254 [No types assigned]