CVE-2024-50028

thermal: core: Reference count the zone in thermal_zone_get_by_id()

Description

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Reference count the zone in thermal_zone_get_by_id() There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802	patch
https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167	patch

Frequently Asked Questions

What is the severity of CVE-2024-50028?: CVE-2024-50028 has been scored as a medium severity vulnerability.
How to fix CVE-2024-50028?: To fix CVE-2024-50028, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-50028 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-50028 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-50028?: CVE-2024-50028 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.