CVE-2024-25740

What it actually does

Memory leak in the UBI driver caused by failure to release kobj->name after handling UBI_IOCATT ioctl, resulting in gradual kernel memory exhaustion and potential denial of service.

Why it matters to the business

Local users or processes on affected Linux systems can trigger repeated memory leaks leading to system instability, crashes, or degraded performance in environments using UBI flash storage.

How an attack unfolds

An attacker with local user privileges crafts repeated calls to the UBI_IOCATT ioctl on systems exposing the UBI subsystem; each invocation leaks kernel memory without release, eventually exhausting resources and causing OOM conditions.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the attach.c memory leak (post-6.7.4 patches that properly release kobj->name); rebuild and deploy the updated kernel across all affected hosts; where immediate patching is not feasible, restrict unprivileged access to UBI ioctls via LSM or seccomp filters.

How to confirm the fix worked

Verify kernel source or binary no longer contains the unreleased kobj->name path in drivers/mtd/ubi/attach.c; confirm updated kernel version boots without the leak under repeated UBI_IOCATT workloads; monitor /proc/meminfo or slabinfo for UBI-related object growth during testing.

Typical attack path

1. Gain local shell or process execution on target Linux system
2. Locate or create conditions exposing UBI character device
3. Invoke UBI_IOCATT ioctl in a tight loop or high-volume manner
4. Monitor system memory until OOM killer activates or kernel panics

How to detect it

Review kernel logs for repeated UBI attach failures or memory allocation warnings; correlate high slab or kmalloc usage with processes performing MTD/UBI ioctls; examine audit logs for frequent UBI_IOCATT calls from non-root users.

What your security team should do

• Prioritize kernel updates on any systems exposing UBI devices or MTD flash
• Audit local user permissions to limit ioctl access on UBI character devices
• Enable kernel memory accounting and OOM monitoring to detect anomalous growth
• Test patched kernels in staging before broad rollout due to storage subsystem impact