Kernel Panic Vulnerability in Linux Package: null_blk Configuration Issue
Summary
CVE-2024-36478: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Writing 'power' and 'submit_queues' concurrently will trigger kernel pa... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The null_blk module is a block device driver that allows for the creation of virtual block devices. This module is useful for testing and development purposes. However, a recent vulnerability has been identified in the null_blk module, which can lead to a kernel panic when certain configurations are applied concurrently.
Vulnerability Detail
The vulnerability arises from a null pointer dereference that occurs when the 'power' and 'submit_queues' configurations are written to simultaneously. This concurrency issue can trigger a kernel panic, leading to system instability. The root cause is a race condition between the deletion of a generic disk and the update of hardware queues, which can result in accessing a null pointer. The technical details indicate that the issue can be reproduced with a specific test script that continuously writes to the affected configurations, ultimately causing a crash.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided to mitigate this vulnerability without applying the fix. However, users can avoid writing to 'power' and 'submit_queues' concurrently until the kernel is updated.
Conclusion
The vulnerability identified in the Linux kernel's null_blk module poses a significant risk of kernel panic due to concurrent configuration writes. Users are advised to update their systems to the latest kernel version to mitigate this risk. Until a fix is applied, avoiding concurrent writes to the affected configurations is recommended.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing the system to crash and potentially resulting in data loss or corruption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
All versions of the Linux kernel that include the null_blk module are potentially affected, particularly those prior to the fix in version 6.9.7-1 for Debian 13.
Avoid concurrent writes to the 'power' and 'submit_queues' configurations as a temporary measure until the kernel is updated.
Detailed information can be found in the CVE report for CVE-2024-36478, and you can also check the Vulert platform for real-time monitoring.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
