Use-After-Free in Linux Kernel IIO Temperature Driver

Executive Summary

This is a Linux kernel vulnerability in the tmp006 temperature sensor driver. The issue occurs because the driver allocates a trigger using devm_iio_trigger_alloc() but registers it with iio_trigger_register() instead of devm_iio_trigger_register(). This mismatch causes the trigger to remain in the global trigger list after module unloading, even though its memory is freed by devm, leading to a dangling entry.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's tmp006 temperature sensor driver and does not provide direct detection commands. It involves a memory management issue where a dangling trigger entry remains after module unload. Check kernel logs for tmp006-related errors or warnings using 'dmesg | grep tmp006' or 'journalctl -k | grep tmp006'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could cause system instability or crashes when the tmp006 driver module is unloaded. The dangling trigger entry may lead to memory corruption or unexpected behavior in the IIO subsystem, potentially affecting temperature monitoring functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel driver for temperature sensors. The issue involves a memory management flaw in the tmp006 driver, which could lead to system instability but does not involve data privacy or security breaches typical of GDPR or HIPAA concerns.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a patched version where the tmp006 driver uses devm_iio_trigger_register() instead of iio_trigger_register().

Useful 0 Not Useful 0