CVE-2024-27006 - Divide Error and Stats Corruption in Linux Thermal Debug (thermal_debug_tz_trip_up)

A recently patched vulnerability in the Linux kernel (CVE-2024-27006) affected how thermal zone trip statistics are updated in the kernel’s debugfs. This subtle bug could crash the kernel or skew temperature statistics due to a missing increment of a count field, making temperature readings in debug logs unreliable and potentially harming system stability. This post breaks down the root cause, demonstrates the vulnerable code, and shows you how to reproduce and understand the impact.

What is CVE-2024-27006?

The issue was found in the thermal management subsystem’s debugfs code—specifically in the way it handles the trip_stats structure. This structure keeps track of how many times a temperature threshold (trip point) was breached. If this count wasn't incremented properly, the code could trigger a divide-by-zero kernel panic or produce invalid statistics, making monitoring tools less reliable.

References

- CVE-2024-27006 at NVD
- linux-stable Commit
- LKML Patch Discussion

Technical Background

On Linux, thermal zones help manage hardware temperature. Each zone may have several *trip points*—thresholds that, when crossed, trigger mitigations such as throttling or shutdown.

In the kernel’s debugfs (a virtual filesystem for kernel debugging), the driver keeps statistics on these trip points, including a counter (“count”) that registers how often each trip is triggered.

Here’s the key error

// Before patch (vulnerable)
if (trip_stats->count)
    trip_stats->avg_temp = 
        ((trip_stats->avg_temp * trip_stats->count) + temp) / trip_stats->count;

Notice: trip_stats->count is used before it is incremented—can be zero! If trip_stats->count is zero, dividing by zero crashes the kernel.

The patch moved the increment so the count is always at least one

// After patch (fixed)
trip_stats->count++;
trip_stats->avg_temp =
    ((trip_stats->avg_temp * (trip_stats->count - 1)) + temp) / trip_stats->count;

By incrementing before dividing, this avoids the divide-by-zero and corrects the logic.

Exploitation Steps

This bug can only be triggered if debugfs is enabled (CONFIG_DEBUG_FS), and someone or some tool is actively using the thermal debugfs stats.

Confirm

cat /proc/config.gz | gunzip | grep DEBUG_FS

2. Trigger a new trip point crossing.

Increase CPU load so processor or SoC gets hot enough to cross a thermal trip point.

3. Access the thermal zone debug stats.

cat /sys/kernel/debug/thermal/thermal_zone*/tz_stats

On a vulnerable kernel, this read can crash the kernel with something like Divide error: 000 [#1] SMP.

4. Watch for crash

Kernel panic and reboot, logs show a divide error in thermal/debugfs code.

Use at your own risk! Running this on a production machine will crash the kernel.

// This is a minimal illustration of the bug logic (not full kernel code)
struct trip_stats {
    int count;
    int avg_temp;
};

void buggy_trip_up(struct trip_stats *stats, int temp) {
    // This may divide by zero if stats->count == :
    if (stats->count)
        stats->avg_temp = ((stats->avg_temp * stats->count) + temp) / stats->count;
    // missing stats->count++;
}

In kernel 6.8 and above, the bug is fixed like this

void fixed_trip_up(struct trip_stats *stats, int temp) {
    stats->count++; // FIX: increment first!
    stats->avg_temp = ((stats->avg_temp * (stats->count - 1)) + temp) / stats->count;
}

Real patch:
thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()

Real-World Impact

- Server or appliance reboots: If you use debugfs-based health checks for hardware, your Linux system might unexpectedly reboot.
- Embedded/industrial devices: These platforms often use debugfs for field diagnostics—risk of unexpected downtime.
- Cloud/NOC: Automated temperature monitors and health audits using debugfs could inadvertently trigger system crashes.

Mitigation & Recommendations

- Upgrade your kernel: Linux 6.8+ contains the fix. Patch now especially if using debugfs or custom thermal monitoring scripts!

For stable branches: Check for backports to your distro's kernel.

- Disable debugfs in production: If possible, mount debugfs only temporarily and unmount during normal operation.

Conclusion

CVE-2024-27006 highlights how minor-seeming mistakes in kernel debug code can cause critical failures. Always patch promptly and be mindful of the risks of accessing debug-fs data!

Do you have systems using debugfs? Double-check your kernel version and patch today!

Timeline

Published on: 05/01/2024 06:15:19 UTC
Last modified on: 05/04/2025 09:02:00 UTC