Subject: CVE-2023-52868: thermal: core: prevent potential string overflow

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

thermal: core: prevent potential string overflow

The dev->id value comes from ida_alloc() so it's a number between zero
and INT_MAX.  If it's too high then these sprintf()s will overflow.

The Linux kernel CVE team has assigned CVE-2023-52868 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 4.14.330 with commit b55f0a9f865b
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 4.19.299 with commit 6ad1bf47fbe5
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 5.4.261 with commit 3091ab943dfc
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 5.10.201 with commit 3f795fb35c2d
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 5.15.139 with commit 3a8f4e58e1ee
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 6.1.63 with commit 77ff34a56b69
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 6.5.12 with commit 0f6b3be28c4d
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 6.6.2 with commit edbd6bbe40ac
	Issue introduced in 2.6.25 with commit 203d3d4aa482 and fixed in 6.7 with commit c99626092efc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52868
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/thermal/thermal_core.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b55f0a9f865be75ca1019aad331f3225f7b50ce8
	https://git.kernel.org/stable/c/6ad1bf47fbe5750c4d5d8e41337665e193e2c521
	https://git.kernel.org/stable/c/3091ab943dfc7b2578599b0fe203350286fab5bb
	https://git.kernel.org/stable/c/3f795fb35c2d8a637efe76b4518216c9319b998c
	https://git.kernel.org/stable/c/3a8f4e58e1ee707b4f46a1000b40b86ea3dd509c
	https://git.kernel.org/stable/c/77ff34a56b695e228e6daf30ee30be747973d6e8
	https://git.kernel.org/stable/c/0f6b3be28c4d62ef6498133959c72266629bea97
	https://git.kernel.org/stable/c/edbd6bbe40ac524a8f2273ffacc53edf14f3c686
	https://git.kernel.org/stable/c/c99626092efca3061b387043d4a7399bf75fbdd5