Bug 2265651 (CVE-2023-52449)
| Summary: | CVE-2023-52449 kernel: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, xili, ycote, ykopkova, zhijwang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A NULL pointer dereference was found in the Linux kernel. This issue is caused by the ftl notifier in gluebi_read() and may lead to a crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2265643 | ||
We dont build gluebi in rhel-8: [wmealing@fedora rhel-8]$ grep GLUEBI ./redhat/configs/ -R ./redhat/configs/kernel-4.18.0-ppc64le.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-4.18.0-aarch64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-4.18.0-x86_64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-4.18.0-x86_64.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/generic/CONFIG_MTD_UBI_GLUEBI:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-4.18.0-aarch64.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-4.18.0-ppc64le-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set Closing tracker We dont build gluebi in rhel-9: [wmealing@fedora rhel-9]$ grep GLUEBI ./redhat/configs/ -R ./redhat/configs/kernel-5.14.0-aarch64-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-ppc64le.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-ppc64le-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-x86_64-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64-rt-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/common/generic/CONFIG_MTD_UBI_GLUEBI:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64-64k.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64-64k-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-x86_64-rt.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-ppc64le-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-aarch64-rt.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-x86_64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-x86_64-rt-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set ./redhat/configs/kernel-5.14.0-x86_64.config:# CONFIG_MTD_UBI_GLUEBI is not set Closing trackers Please update notaffected for 8 and 9, an kernel-rt. Thank you. |
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.