Executive brief
A flaw in the Linux kernel's UBI (Unsorted Block Image) subsystem can cause the system to enter an infinite loop when wear-leveling operations encounter flash faults. This can freeze kernel threads and make affected systems unresponsive, disrupting normal operations for devices that rely on NAND flash storage.
Technical details
A race condition exists in the ubi_wl_put_peb() function in drivers/mtd/ubi/wl.c. When the wear-leveling worker encounters a flash I/O error during wear-leveling operations, it clears the wear-level entry from the lookup table but leaves a stale pointer. Concurrently, ubi_wl_put_peb() can retrieve a NULL pointer from the lookup table and incorrectly matches it against a NULL move_from pointer, causing an infinite retry loop (NULL == ubi->move_from evaluates to true). The fix involves: (1) checking if the wear-level entry has been removed and returning early if so, and (2) protecting wear-level entry deletion with the wl_lock spinlock to prevent use-after-free. The vulnerability requires concurrent execution of wear-leveling and unmapping operations, making it triggerable on systems using UBIFS with flash faults.
Affected products
- Linux Linux kernel Multiple versions (patch added to stable branches from 5.4.y onwards and earlier branches)
Timeline
- 2023-03-11: disclosed: Fix merged into Linux stable tree
- 2023-10-01: other: CVE published