CVE-2024-50080: ublk: don't allow user copy for unprivileged device
In the Linux kernel, the following vulnerability has been resolved:
ublk: don't allow user copy for unprivileged device
UBLKFUSERCOPY requires userspace to call write() on ublk char device for filling request buffer, and unprivileged device can't be trusted.
So don't allow user copy for unprivileged device.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50080?
CVE-2024-50080 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50080?
To fix CVE-2024-50080, update to the patched versions of the Linux kernel, such as 5.10.223-1, 6.1.123-1, or 6.12.12-1.
Which versions of the Linux kernel are affected by CVE-2024-50080?
CVE-2024-50080 affects several Linux kernel versions between 6.5 and 6.6.58, as well as 6.7 to 6.11.5 and the 6.12 release candidates.
What is UBLK_F_USER_COPY in relation to CVE-2024-50080?
UBLK_F_USER_COPY is a feature that should not allow unprivileged devices to make user copies, which is the basis of CVE-2024-50080.
Is CVE-2024-50080 related to user privilege escalation?
Yes, CVE-2024-50080 is related to user privilege escalation risks due to the handling of unprivileged devices in the Linux kernel.