Executive Summary

This vulnerability exists in the Linux kernel's ublk subsystem, specifically in the function ublk_ctrl_set_size(). The function dereferences a pointer ub->ub_disk without checking if it is NULL. This pointer is NULL before the device start command (UBLK_CMD_START_DEV) completes and after the device stop command (UBLK_CMD_STOP_DEV) runs. Because the UBLK_CMD_UPDATE_SIZE handler does not validate the device state, an attacker can cause a NULL pointer dereference by sending an UPDATE_SIZE command to a device that is either added but not started or has been stopped.

The issue is fixed by adding a check for ub->ub_disk under a mutex before dereferencing it, returning an error (-ENODEV) if the disk is not available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a NULL pointer dereference in the Linux kernel, which typically results in a kernel crash or system instability. An attacker with the ability to send specific commands to the ublk device can exploit this to cause a denial of service (DoS) by crashing the system or disrupting its normal operation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update your Linux kernel to a version that includes the fix for the NULL pointer dereference in ublk_ctrl_set_size().

The fix involves checking the ub->ub_disk pointer under ub->mutex before dereferencing it and returning an error if the disk is not available, preventing the NULL pointer dereference.

Until the update is applied, avoid sending UBLK_CMD_UPDATE_SIZE commands to devices that have been added but not yet started, or to devices that have been stopped.

Useful 0 Not Useful 0