CVE-2024-36478

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'

Writing 'power' and 'submit_queues' concurrently will trigger kernel

panic:

Test script:

modprobe null_blk nr_devices=0

mkdir -p /sys/kernel/config/nullb/nullb0

while true; do echo 1 > submit_queues; echo 4 > submit_queues; done &

while true; do echo 1 > power; echo 0 > power; done

Test result:

BUG: kernel NULL pointer dereference, address: 0000000000000148

Oops: 0000 [#1] PREEMPT SMP

RIP: 0010:__lock_acquire+0x41d/0x28f0

Call Trace:

<TASK>

lock_acquire+0x121/0x450

down_write+0x5f/0x1d0

simple_recursive_removal+0x12f/0x5c0

blk_mq_debugfs_unregister_hctxs+0x7c/0x100

blk_mq_update_nr_hw_queues+0x4a3/0x720

nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]

nullb_device_submit_queues_store+0x79/0xf0 [null_blk]

configfs_write_iter+0x119/0x1e0

vfs_write+0x326/0x730

ksys_write+0x74/0x150

This is because del_gendisk() can concurrent

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References