CVE-2021-47202

What it actually does

NULL pointer dereference in of_thermal_set_trip_temp, of_thermal_get_temp, of_thermal_set_emul_temp and of_thermal_get_trend when a thermal zone references a sensor that has not yet probed, triggered via sysfs attribute writes.

Why it matters to the business

Local users can trigger kernel panics leading to system crashes, unplanned reboots and loss of availability on affected Linux systems; high ecosystem prevalence of the Linux kernel increases widespread exposure.

How an attack unfolds

An attacker with local access writes values to thermal zone trip_point or emulation sysfs files; because the backing sensor device is absent the kernel follows a NULL pointer in the of_thermal helper and crashes. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Apply the upstream fix for of_parse_thermal_zones and the of_thermal_* helpers; rebuild and deploy a patched kernel image. Reboot systems after installation. Monitor vendor advisories for distribution-specific backports.

How to confirm the fix worked

Confirm the patched kernel no longer contains the vulnerable of_thermal_* functions by inspecting the source or running a kernel version string check; attempt the original sysfs write in a test environment and verify it no longer panics.

Typical attack path

1. Obtain local shell or user context on a Linux system
2. Locate a thermal_zoneN directory under /sys/class/thermal whose sensor has not probed
3. Write an integer value to trip_point_0_temp or similar attribute
4. Kernel executes of_thermal_set_trip_temp (or related function) on NULL sensor pointer
5. NULL dereference causes kernel panic and system reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for "Unable to handle kernel NULL pointer dereference" with call traces containing of_thermal_set_trip_temp or trip_point_temp_store; correlate with recent writes to thermal sysfs entries.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux hosts
• Restrict unprivileged write access to /sys/class/thermal via mount options or SELinux/AppArmor policy
• Include thermal sysfs paths in endpoint detection rules for anomalous writes
• Test patched kernels in staging before broad rollout given the 923-day disclosure window