Log in Start free

Vulnerability · Published Sep 18, 2024 · Assigned by Linux

CVE-2024-46735ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 84.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() When two UBLK_CMD_START_USER_RECOVERY commands are submitted, the first one sets 'ubq->ubq_daemon' to NULL, and the second one triggers WARN in ublk_queue_reinit() and subsequently a NULL pointer dereference issue. Fix it by adding the check in ublk_ctrl_start_recovery() and return immediately in case of zero 'ub->nr_queues_ready'. BUG: kernel NULL pointer dereference, address: 0000000000000028 RIP: 0010:ublk_ctrl_start_recovery.constprop.0+0x82/0x180 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x75/0x170 ? exc_page_fault+0x64/0x140 ? asm_exc_page_fault+0x22/0x30 ? ublk_ctrl_start_recovery.constprop.0+0x82/0x180 ublk_ctrl_uring_cmd+0x4f7/0x6c0 ? pick_next_task_idle+0x26/0x40 io_uring_cmd+0x9a/0x1b0 io_issue_sqe+0x193/0x3f0 io_wq_submit_work+0x9b/0x390 io_worker_handle_work+0x165/0x360 io_wq_worker+0xcb/0x2f0 ? finish_task_switch.isra.0+0x203/0x290 ? finish_task_switch.isra.0+0x203/0x290 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.112-1DEBIAN-CVE-2024-46735
Debian:13linux6.10.11-1DEBIAN-CVE-2024-46735
Debian:14linux6.10.11-1DEBIAN-CVE-2024-46735
Ubuntu:24.04:LTSlinux6.8.0-50.51UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-aws6.8.0-1020.22UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1020.22~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-azure6.8.0-1020.23UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1020.23~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-gcp6.8.0-1019.21UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-gke6.8.0-1015.19UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-50.51~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-ibm6.8.0-1017.17UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-50.51.1UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1019.21UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1019.21.1UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1018.18UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-oracle6.8.0-1017.18UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1017.18~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-raspi6.8.0-1016.18UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-46735
Ubuntu:24.04:LTSlinux-riscv6.8.0-50.51.1UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-46735
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-46735

Affected products (as reported)

VendorProductVersions
Linux Linux c732a852b419fa057b53657e2daaf9433940391c – before ca249435893dda766f3845c15ca77ca5672022d8c732a852b419fa057b53657e2daaf9433940391c – before 136a29d8112df4ea0a57f9602ddf3579e04089dcc732a852b419fa057b53657e2daaf9433940391c – before 7c890ef60bf417d3fe5c6f7a9f6cef0e1d77f74fc732a852b419fa057b53657e2daaf9433940391c – before e58f5142f88320a5b1449f96a146f2f24615c5c7
Linux Linux 6.1

References