Junglewise Threat Intelligence

CVE-2023-52458: Linux kernel null pointer dereference in block partition resizing

CVE-2023-52458 · Severity: medium · CVSS 5.5 · Published 2024-02-23

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's block layer could allow a local user to cause a system crash or I/O errors. The issue occurs when creating or resizing disk partitions with lengths that do not align with the disk's physical block size. This can lead to a 'null pointer dereference,' effectively crashing the system or causing data access failures on affected storage devices.

Technical details

A vulnerability exists in the Linux kernel block layer's ioctl handling (specifically in `blkpg_do_ioctl`). Before adding or resizing a partition, the kernel did not verify if the requested partition length was aligned with the device's logical block size. On disks with logical block sizes larger than 512 bytes, an unaligned partition length causes `bio_truncate()` to adjust the bio size during the final sector read. If the resulting read command is smaller than the logical block size, it triggers an I/O error. Furthermore, if the device supports integrity data, this state leads to a null pointer dereference in `bio_integrity_free`. A local attacker with sufficient privileges to modify partitions (e.g., CAP_SYS_ADMIN) could exploit this to cause a Denial of Service (DoS). The issue has been patched by adding alignment checks using `IS_ALIGNED` in `block/ioctl.c`.

Affected products

  • Linux Linux Kernel up to 5.10.215, 5.11.0 to 5.15.148, 5.16.0 to 6.1.75, 6.2.0 to 6.6.14, 6.7.0 to 6.7.2

Timeline

  • 2023-06-29: other: Initial patch submitted by developer
  • 2024-02-23: disclosed: CVE published
  • 2024-01-25: patched: Fix committed to stable branches

References

Related threats