CVE-2021-46940

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-46940
In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix offset overflow issue in index converting The idx_to_offset() function returns type int (32-bit signed), but MSR_PKG_ENERGY_STAT is u32 and would be interpreted as a negative number. The end result is that it hits the if (offset < 0) check in update_msr_sum() which prevents the timer callback from updating the stat in the background when long durations are used. The similar issue exists in offset_to_idx() and update_msr_sum(). Fix this issue by converting the 'int' to 'off_t' accordingly.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/13a779de4175df602366d129e41782ad7168cef0 Patch
https://git.kernel.org/stable/c/337b1546cde87fb8588ddaedf0201b769baa572a Patch
https://git.kernel.org/stable/c/dbdf22fc825fdb1d97f23230064e0f9819471628 Patch
https://git.kernel.org/stable/c/ea6803ff2cd1a2d7d880256bf562172b708a76ff Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Apr 2024, 19:44

Type Values Removed Values Added
CWE CWE-190
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/13a779de4175df602366d129e41782ad7168cef0 - () https://git.kernel.org/stable/c/13a779de4175df602366d129e41782ad7168cef0 - Patch
References () https://git.kernel.org/stable/c/337b1546cde87fb8588ddaedf0201b769baa572a - () https://git.kernel.org/stable/c/337b1546cde87fb8588ddaedf0201b769baa572a - Patch
References () https://git.kernel.org/stable/c/dbdf22fc825fdb1d97f23230064e0f9819471628 - () https://git.kernel.org/stable/c/dbdf22fc825fdb1d97f23230064e0f9819471628 - Patch
References () https://git.kernel.org/stable/c/ea6803ff2cd1a2d7d880256bf562172b708a76ff - () https://git.kernel.org/stable/c/ea6803ff2cd1a2d7d880256bf562172b708a76ff - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: herramientas/turbostat de potencia: soluciona el problema de desbordamiento de compensación en la conversión de índice. La función idx_to_offset() devuelve el tipo int (32 bits firmado), pero MSR_PKG_ENERGY_STAT es u32 y se interpretaría como negativo. número. El resultado final es que alcanza la verificación if (offset &lt; 0) en update_msr_sum(), lo que evita que la devolución de llamada del temporizador actualice la estadística en segundo plano cuando se utilizan duraciones prolongadas. Existe un problema similar en offset_to_idx() y update_msr_sum(). Solucione este problema convirtiendo 'int' a 'off_t' en consecuencia.

27 Feb 2024, 19:04

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 19:04

Updated : 2024-04-10 19:44

NVD link : CVE-2021-46940

Mitre link : CVE-2021-46940

CVE.ORG link : CVE-2021-46940

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound