CVE-2024-46735

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()

When two UBLK_CMD_START_USER_RECOVERY commands are submitted, the

first one sets 'ubq->ubq_daemon' to NULL, and the second one triggers

WARN in ublk_queue_reinit() and subsequently a NULL pointer dereference

issue.

Fix it by adding the check in ublk_ctrl_start_recovery() and return

immediately in case of zero 'ub->nr_queues_ready'.

BUG: kernel NULL pointer dereference, address: 0000000000000028

RIP: 0010:ublk_ctrl_start_recovery.constprop.0+0x82/0x180

Call Trace:

<TASK>

? __die+0x20/0x70

? page_fault_oops+0x75/0x170

? exc_page_fault+0x64/0x140

? asm_exc_page_fault+0x22/0x30

? ublk_ctrl_start_recovery.constprop.0+0x82/0x180

ublk_ctrl_uring_cmd+0x4f7/0x6c0

? pick_next_task_idle+0x26/0x40

io_uring_cmd+0x9a/0x1b0

io_issue_sqe+0x193/0x3f0

io_wq_submit_work+0x9b/0x390

io_worker_handle_work+0x165/0x360

io_wq_w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References