Bug 2265651 (CVE-2023-52449) - CVE-2023-52449 kernel: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
Summary: CVE-2023-52449 kernel: mtd: Fix gluebi NULL pointer dereference caused by ftl...
Keywords:
Status: NEW
Alias: CVE-2023-52449
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2265643
TreeView+ depends on / blocked
 
Reported: 2024-02-23 13:47 UTC by Patrick Del Bello
Modified: 2024-04-05 18:18 UTC (History)
50 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Patrick Del Bello 2024-02-23 13:47:26 UTC 
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
triggers NULL pointer dereference when trying to access
‘gluebi->desc’ in gluebi_read().

ubi_gluebi_init
  ubi_register_volume_notifier
    ubi_enumerate_volumes
      ubi_notify_all
        gluebi_notify    nb->notifier_call()
          gluebi_create
            mtd_device_register
              mtd_device_parse_register
                add_mtd_device
                  blktrans_notify_add   not->add()
                    ftl_add_mtd         tr->add_mtd()
                      scan_header
                        mtd_read
                          mtd_read_oob
                            mtd_read_oob_std
                              gluebi_read   mtd->read()
                                gluebi->desc - NULL

Detailed reproduction information available at the Link [1],

In the normal case, obtain gluebi->desc in the gluebi_get_device(),
and access gluebi->desc in the gluebi_read(). However,
gluebi_get_device() is not executed in advance in the
ftl_add_mtd() process, which leads to NULL pointer dereference.

The solution for the gluebi module is to run jffs2 on the UBI
volume without considering working with ftl or mtdblock [2].
Therefore, this problem can be avoided by preventing gluebi from
creating the mtdblock device after creating mtd partition of the
type MTD_UBIVOLUME.
Comment 2 Wade Mealing 2024-02-27 03:42:36 UTC 
We dont build gluebi in rhel-8:

[wmealing@fedora rhel-8]$ grep GLUEBI ./redhat/configs/ -R
./redhat/configs/kernel-4.18.0-ppc64le.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-4.18.0-aarch64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-4.18.0-x86_64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-4.18.0-x86_64.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/generic/CONFIG_MTD_UBI_GLUEBI:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-4.18.0-aarch64.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-4.18.0-ppc64le-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set

Closing tracker

We dont build gluebi in rhel-9:

[wmealing@fedora rhel-9]$ grep GLUEBI ./redhat/configs/ -R
./redhat/configs/kernel-5.14.0-aarch64-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-ppc64le.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-ppc64le-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-x86_64-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64-rt-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/common/generic/CONFIG_MTD_UBI_GLUEBI:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64-64k.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64-64k-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-x86_64-rt.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-ppc64le-kgcov.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-aarch64-rt.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-x86_64-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-x86_64-rt-debug.config:# CONFIG_MTD_UBI_GLUEBI is not set
./redhat/configs/kernel-5.14.0-x86_64.config:# CONFIG_MTD_UBI_GLUEBI is not set



Closing trackers

Please update notaffected for 8 and 9, an kernel-rt. 

Thank you.
Note You need to log in before you can comment on or make changes to this bug.