CVE-2024-36478 null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
Concurrent configuration of null_blk power and submit_queues causes a kernel null pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36478?
CVE-2024-36478 is a medium-severity vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
Writing 'power' and 'submit_queues' concurrently will trigger kernel panic:
Test script:
modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & while true; do echo 1 > power; echo 0 > power; done
Test result:
BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:__lock_acquire+0x41d/0x28f0 Call Trace: <TASK> lock_acquire+0x121/0x450 down_write+0x5f/0x1d0 simple_recursive_removal+0x12f/0x5c0 blk_mq_debugfs_unregister_hctxs+0x7c/0x100 blk_mq_update_nr_hw_queues+0x4a3/0x720 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x79/0xf0 [null_blk] configfs_write_iter+0x119/0x1e0 vfs_write+0x326/0x730 ksys_write+0x74/0x150
This is because del_gendisk() can concurrent with blk_mq_update_nr_hw_queues():
nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if (!dev->nullb) // still set while gendisk is deleted return 0 blk_mq_update_nr_hw_queues dev->nullb = NULL
Fix this problem by resuing the global mutex to protect nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs.
Weakness: CWE-476
Which versions are affected by CVE-2024-36478?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-36478?
Apply the vendor's patch.
Is CVE-2024-36478 being exploited?
There is no known exploitation of CVE-2024-36478 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48948, AZL-48962, BELL-CVE-2024-36478, DEBIAN-CVE-2024-36478, GHSA-66hj-w2gx-rg6c, ROOT-OS-DEBIAN-11-CVE-2024-36478 and 2 more.