CVE-2024-46735: ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
In the Linux kernel, the following vulnerability has been resolved:
ublkdrv: fix NULL pointer dereference in ublkctrlstartrecovery()
When two UBLKCMDSTARTUSERRECOVERY commands are submitted, the first one sets 'ubq->ubqdaemon' to NULL, and the second one triggers WARN in ublkqueuereinit() and subsequently a NULL pointer dereference issue.
Fix it by adding the check in ublkctrlstartrecovery() and return immediately in case of zero 'ub->nrqueuesready'.
BUG: kernel NULL pointer dereference, address: 0000000000000028 RIP: 0010:ublkctrlstartrecovery.constprop.0+0x82/0x180 Call Trace: <TASK> ? die+0x20/0x70 ? pagefaultoops+0x75/0x170 ? excpagefault+0x64/0x140 ? asmexcpagefault+0x22/0x30 ? ublkctrlstartrecovery.constprop.0+0x82/0x180 ublkctrluringcmd+0x4f7/0x6c0 ? picknexttaskidle+0x26/0x40 iouringcmd+0x9a/0x1b0 ioissuesqe+0x193/0x3f0 iowqsubmitwork+0x9b/0x390 ioworkerhandlework+0x165/0x360 iowqworker+0xcb/0x2f0 ? finishtaskswitch.isra.0+0x203/0x290 ? finishtaskswitch.isra.0+0x203/0x290 ? pfxiowqworker+0x10/0x10 retfromfork+0x2d/0x50 ? pfxiowqworker+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46735?
CVE-2024-46735 has a medium severity rating due to its potential to cause system instability.
How do I fix CVE-2024-46735?
To fix CVE-2024-46735, update the Linux kernel to a version that includes patches for this vulnerability.
Which versions of Linux kernel are affected by CVE-2024-46735?
The affected versions of the Linux kernel range from 6.1.0 to 6.11-rc6, including specific release candidates.
What is the nature of the vulnerability in CVE-2024-46735?
CVE-2024-46735 is a null pointer dereference vulnerability that occurs when multiple UBLK_CMD_START_USER_RECOVERY commands are submitted.
Are there any workarounds for CVE-2024-46735 before applying a patch?
Currently, the recommended approach is to update to the patched Linux kernel versions as no reliable workarounds have been provided.