Executive brief
The Linux kernel's UBI (Unsorted Block Images) subsystem, used for managing flash memory storage, contains a use-after-free vulnerability in its volume resizing code. A local attacker with access to UBI device controls can trigger this flaw by resizing a volume multiple times, potentially leading to kernel crashes or local privilege escalation.
Technical details
A use-after-free vulnerability exists in the UBI volume resizing logic (ubi_resize_volume function in drivers/mtd/ubi/vmt.c). When ubi_change_vtbl_record() fails during volume resizing, the error handling path frees the newly allocated EBA (Erased Block Association) table, but this table is already referenced by the volume structure. On subsequent volume resize operations, the stale pointer is accessed, causing a use-after-free condition detectable by KASAN. The vulnerability requires local access to UBI device ioctl interfaces and can be exploited by local unprivileged users to crash the kernel or potentially achieve code execution. The fix involves correcting the error handling flow to skip the premature free operation when the table has been transferred to the volume structure.
Affected products
- Linux Linux kernel 6.1.0-rc1 and earlier (affects multiple stable branches)
Timeline
- 2023-03-11: disclosed
- other: Upstream commit 9af31d6ec1a4be4caab2550096c6bd2ba8fba472 authored by Li Zetao
- 2023-03-11: patched: Fix merged into Linux stable tree