CVE-2024-53184
NoneCVSS
—
EPSS
0.3%
Published
Dec 27, 2024
CISA due date
—
Cloudanix analysis
A flaw in how certain virtual disk devices are cleaned up can cause the whole computer to crash when those devices are removed.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in Linux kernel ubd driver release path due to accessing drvdata after it is unavailable, resulting in invalid pointer dereference and kernel panic during blk_mq_free_tag_set.
Why it matters to the business
Unexpected system crashes and denial of service when removing ubd devices in virtualized or user-mode Linux environments, disrupting operations and requiring reboots.
How an attack unfolds
An attacker with access to management console triggers ubd device removal via mconsole_remove, which calls ubd_remove and subsequently the release handler that dereferences stale drvdata instead of using container_of, leading to segfault and kernel panic.
How to fix it
Apply the upstream fix that replaces drvdata access with container_of() to retrieve the ubd instance; update to a kernel version containing the resolution for CVE-2024-53184.
How to confirm the fix worked
Confirm the release handler uses container_of() on the device structure; test device add/remove cycles under load to ensure no panic occurs; monitor for absence of the described RIP in blk_mq_free_tag_set during removal.
Typical attack path
- Obtain privileges to issue mconsole commands
- Invoke mconsole_remove to unregister ubd device
- Trigger ubd_device_release during kobject cleanup
- Dereference invalid drvdata pointer in blk_mq_free_tag_set
- Cause kernel panic and denial of service
How to detect it
Review kernel logs for 'ubd_device_release' entries followed by 'blk_mq_free_tag_set' RIP values and 'Kernel panic - not syncing: Segfault with no mm'; inspect workqueue activity involving mc_work_proc and mconsole_remove calls.
What your security team should do
- Prioritize kernel updates containing the ubd release fix in affected distributions
- Restrict mconsole access to trusted administrators only
- Monitor kernel logs for ubd_device_release and platform_device_unregister crashes
- Test device removal workflows in staging environments before production deployment
The record
In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux | 0 | 5.10.234-1 |
| Debian:11 | linux-6.1 | 0 | 6.1.128-1~deb11u1 |
| Debian:11 | linux-6.1 | 0 | 6.1.6.1.128-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.123-1 |
| Debian:13 | linux | 0 | 6.12.3-1 |
| Linux | Kernel | 0 | 4.19.325 |
| Linux | Kernel | 3.6.0 | 4.19.325 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:20.04:LTS | linux | 0 | No fix |
| Ubuntu:20.04:LTS | linux | 0 | 5.4.0-211.231 |
| Ubuntu:20.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws | 0 | 5.4.0-1142.152 |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1080.87~20.04.1 |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | 5.4.0-1147.154 |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1086.95~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | No fix |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | 5.4.0-1101.108 |
| Ubuntu:20.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp | 0 | 5.4.0-1145.154 |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1081.90~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-136.147~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | 5.4.0-1088.93 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1074.77~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1077.83~20.04.1 |
| Ubuntu:20.04:LTS | linux-iot | 0 | No fix |
| Ubuntu:20.04:LTS | linux-iot | 0 | 5.4.0-1048.51 |
| Ubuntu:20.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-kvm | 0 | 5.4.0-1129.138 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-135.146~20.04.1 |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | 5.4.0-1140.150 |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1077.83~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | 5.4.0-1129.142 |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | 5.15.0-1075.79~20.04.1 |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | 5.4.0-1060.64 |
| Ubuntu:22.04:LTS | linux | 0 | No fix |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-135.146 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1080.87 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1027.29~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1084.93 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | 6.8.0-1027.32~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1079.88 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | 6.8.0-1028.30~22.04.1 |
| Ubuntu:22.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1077.83 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1062.70 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | 6.8.0-58.60~22.04.1 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1072.75 |
| Ubuntu:22.04:LTS | linux-ibm-6.8 | 0 | 6.8.0-1024.24~22.04.1 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | 5.15.0-1073.75 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1075.81 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1076.81 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-135.146 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | 6.8.0-58.60.1~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1074.75 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | 6.8.0-1026.29~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 0 | 5.15.0-1033.33 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 0 | 5.15.0-1021.21 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1077.83 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | 6.8.0-1024.25~22.04.1 |
| Ubuntu:22.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1074.77 |
| Ubuntu:22.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | 6.8.0-58.60.1~22.04.1 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | No fix |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | 5.15.0-1044.48 |
| Ubuntu:22.04:LTS:for:NVIDIA:BlueField | linux-bluefield | 0 | No fix |
| Ubuntu:22.04:LTS:for:NVIDIA:BlueField | linux-bluefield | 0 | 5.15.0-1062.64 |
| Ubuntu:24.04:LTS | linux | 0 | No fix |
| Ubuntu:24.04:LTS | linux | 0 | 6.8.0-58.60 |
| Ubuntu:24.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:24.04:LTS | linux-aws | 0 | 6.8.0-1027.29 |
| Ubuntu:24.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:24.04:LTS | linux-azure | 0 | 6.8.0-1027.32 |
| Ubuntu:24.04:LTS | linux-azure-6.11 | 0 | 6.11.0-1012.12~24.04.1 |
| Ubuntu:24.04:LTS | linux-azure-nvidia | 0 | 6.8.0-1014.15 |
| Ubuntu:24.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gcp | 0 | 6.8.0-1028.30 |
| Ubuntu:24.04:LTS | linux-gcp-6.11 | 0 | 6.11.0-1011.11~24.04.1 |
| Ubuntu:24.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gke | 0 | 6.8.0-1023.27 |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | 6.8.0-1010.12 |
| Ubuntu:24.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:24.04:LTS | linux-ibm | 0 | 6.8.0-1024.24 |
| Ubuntu:24.04:LTS | linux-intel | 0 | No fix |
| Ubuntu:24.04:LTS | linux-lowlatency | 0 | No fix |
| Ubuntu:24.04:LTS | linux-lowlatency | 0 | 6.8.0-58.60.1 |
| Ubuntu:24.04:LTS | linux-nvidia | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia | 0 | 6.8.0-1026.29 |
Related vulnerabilities
- CVE-2025-38562 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects linux
- CVE-2025-22037 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-21760 In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU… Also affects linux
- CVE-2025-21758 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU… Also affects linux
- CVE-2025-21664 In the Linux kernel, the following vulnerability has been resolved: dm thin: make… Also affects linux
- CVE-2024-57946 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't… Also affects linux
- CVE-2024-57945 In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the… Also affects linux