CVE-2024-56764

ublk: detach gendisk from ublk device if add_disk() fails

High · published January 6, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ublk: detach gendisk from ublk device if add_disk() fails

Inside ublk_abort_requests(), gendisk is grabbed for aborting all

inflight requests. And ublk_abort_requests() is called when exiting

the uring context or handling timeout.

If add_disk() fails, the gendisk may have been freed when calling

ublk_abort_requests(), so use-after-free can be caused when getting

disk's reference in ublk_abort_requests().

Fixes the bug by detaching gendisk from ublk device if add_disk() fails.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Published
2025-01-06T16:20Z
EPSS history
Timeline
  • 06 JAN 16:20Z
    ublk: detach gendisk from ublk device if add_disk() fails
    cvelistv5