CVE-2024-53170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: fix uaf for flush rq while iterating tags

blk_mq_clear_flush_rq_mapping() is not called during scsi probe, by

checking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is cleared

in del_gendisk by commit aec89dc5d421 ("block: keep q_usage_counter in

atomic mode after del_gendisk"), hence for disk like scsi, following

blk_mq_destroy_queue() will not clear flush rq from tags->rqs[] as well,

cause following uaf that is found by our syzkaller for v6.6:

==================================================================

BUG: KASAN: slab-use-after-free in blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261

Read of size 4 at addr ffff88811c969c20 by task kworker/1:2H/224909

CPU: 1 PID: 224909 Comm: kworker/1:2H Not tainted 6.6.0-ga836a5060850 #32

Workqueue: kblockd blk_mq_timeout_work

Call Trace:

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106

print_address_descrip

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References