CVE-2024-0443

What it actually does

The blkgs destruction path in block/blk-cgroup.c contains a circular reference that skips cgroup_rstat_flush() until css_release_work_fn() when the blkcg reference count hits zero, leaving blkcg structures and associated blkgs allocated after they are marked offline and causing unbounded kernel memory growth.

Why it matters to the business

Local users or processes can exhaust kernel memory on affected Ubuntu 20.04 systems, leading to out-of-memory conditions, service degradation, or forced reboots; the issue affects widely deployed cloud and container workloads but carries low exploitation likelihood given the 1000+ day publication window and stable low EPSS.

How an attack unfolds

An attacker with local shell or container access repeatedly creates and destroys cgroups that exercise the blkio controller, preventing reference counts from reaching zero and accumulating leaked blkcg/blkgs objects until the kernel OOM killer activates or the system becomes unresponsive.

How to fix it

Upgrade the running kernel to one of the fixed versions: linux 5.4.0-9.12 or later, linux-aws 5.4.0-1005.5 or later, linux-aws-5.15 5.15.0-1014.18~20.04.1 or later, linux-azure 5.4.0-1006.6 or later, linux-azure-5.15 5.15.0-1007.8~20.04.1 or later, linux-azure-fde-5.15 5.15.0-1019.24~20.04.1.1 or later, linux-bluefield 5.4.0-1007.10 or later, linux-gcp 5.4.0-1005.5 or later, linux-gcp-5.15 5.15.0-1006.9~20.04.1 or later, linux-gkeop 5.4.0-1008.9 or later, linux-gkeop-5.15 5.15.0-1003.5~20.04.2 or later, linux-hwe-5.15 5.15.0-33.34~20.04.1 or later, or linux-ibm 5.4.0-1003.4 or later; reboot after package installation.

How to confirm the fix worked

Verify the installed kernel version matches or exceeds the listed fixed package for the distribution variant, then confirm that cgroup creation/destruction cycles no longer produce unbounded blkcg allocations via slabinfo or kmemleak checks.

Typical attack path

1. Obtain local user or unprivileged container access on an affected Ubuntu 20.04 kernel
2. Create cgroups that attach blkio controllers
3. Trigger repeated cgroup destruction sequences that exercise the circular dependency in blk-cgroup.c
4. Observe progressive kernel memory consumption until OOM or instability occurs

How to detect it

Review kernel logs for repeated OOM killer invocations correlated with cgroup lifecycle events; inspect slabinfo or kmemleak output for growing blkcg and blkg objects on systems that have not yet been updated.

What your security team should do

• Prioritize kernel package upgrades on all Ubuntu 20.04 LTS systems within the next maintenance window
• Reboot systems after kernel updates to activate the fixed code path
• Monitor memory usage trends on systems that cannot be immediately patched
• Restrict untrusted local code execution where feasible until patches are applied