CVE-2024-50080

What it actually does

The flaw permits unprivileged ublk devices to enable UBLK_F_USER_COPY, allowing userspace write() calls on the ublk character device to populate request buffers that should only be trusted for privileged devices.

Why it matters to the business

Untrusted users could interfere with block device request handling on affected Linux systems, risking storage data corruption or unauthorized manipulation of I/O operations with moderate operational disruption.

How an attack unfolds

An attacker creates or accesses an unprivileged ublk device, enables the USER_COPY feature flag, then issues write() operations on the character device to inject or alter request buffer contents, bypassing intended authorization controls. Context from listed threat actors indicates potential use in broader Linux kernel exploitation campaigns.

How to fix it

Upgrade affected packages to fixed versions: postgresql-9.1 to 9.1.19-0ubuntu0.14.04 and postgresql-9.3 to 9.3.10-0ubuntu0.14.04 (or equivalent kernel updates that enforce the restriction). Prioritize patching due to 713 days since publication and listed threat actor activity.

How to confirm the fix worked

Confirm kernel source or package versions match or exceed the listed fixed releases; test that UBLK_F_USER_COPY is rejected for unprivileged devices via device creation attempts.

Typical attack path

1. Locate or instantiate an unprivileged ublk device
2. Enable UBLK_F_USER_COPY flag on the device
3. Issue write() system calls to the ublk character device
4. Manipulate in-flight request buffers for malicious effect

How to detect it

Review system logs for ublk device creation events followed by unexpected write() activity on associated character devices; examine kernel audit trails for authorization bypass attempts in block layer operations. Consider threat actor patterns around Linux kernel resource and bounds issues.

What your security team should do

• Apply listed package upgrades immediately on all systems using ublk
• Audit ublk device usage for unprivileged contexts
• Monitor EPSS and threat actor reports for changes in exploitation likelihood
• Restrict unprivileged access to block device character interfaces