CVE-2024-54458

What it actually does

Failure to null the bsg_queue pointer after removal in the UFS BSG driver leaves a dangling reference that can be dereferenced after the underlying queue is freed, enabling a use-after-free condition in the Linux kernel SCSI subsystem.

Why it matters to the business

Unpatched Linux kernel deployments face elevated risk of system instability, crashes, or potential privilege escalation that can disrupt storage operations and require emergency patching across fleets of servers and embedded devices.

How an attack unfolds

An attacker with the ability to trigger UFS BSG queue removal and subsequent reuse of the freed structure can cause the kernel to access freed memory, leading to crashes or controlled memory corruption that may be escalated to arbitrary code execution.

How to fix it

Update the Linux kernel to the commit bb4783c670180b922267222408e1c48d22dfbb46 or later stable releases that contain the fix; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel source contains the commit bb4783c670180b922267222408e1c48d22dfbb46; inspect the ufs-bsg driver to confirm bsg_queue is set to NULL after removal; recompile and boot test kernels to ensure the change is present.

Typical attack path

1. Obtain local access or load a malicious kernel module capable of interacting with the UFS BSG interface
2. Trigger removal of a UFS BSG queue while a reference remains held
3. Reuse the freed queue structure before the pointer is cleared
4. Leverage the resulting use-after-free for memory corruption or information disclosure

How to detect it

Examine kernel logs and crash dumps for UFS BSG related use-after-free warnings or oops messages; correlate with processes that interact with SCSI generic devices around the time of the fault.

What your security team should do

• Prioritize kernel updates to the fixed commit in all production and edge Linux deployments within the next maintenance window
• Review kernel configurations that expose UFS BSG interfaces and restrict access where possible
• Monitor upstream stable kernel releases for additional related fixes