Junglewise Threat Intelligence

CVE-2024-25739: Linux Kernel denial of service in UBI volume table driver

CVE-2024-25739 · Severity: medium · CVSS 5.5 · Published 2024-02-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's storage management system could allow a local user to crash the operating system. The issue occurs when the system handles specific flash memory storage configurations, leading to a system failure or 'kernel panic.' This results in a denial of service, potentially disrupting operations or causing data loss if the system is not properly shut down.

Technical details

A vulnerability exists in the create_empty_lvol function within drivers/mtd/ubi/vtbl.c of the Linux kernel. The root cause is a missing validation check for the Logical Eraseblock (LEB) size (ubi->leb_size). If the LEB size is smaller than the required volume table record size, the kernel attempts to allocate zero bytes or perform invalid division, leading to a kernel crash. A local attacker with sufficient privileges to trigger UBI volume operations could exploit this to cause a denial of service. Patches have been released in various stable kernel branches (e.g., 6.6.24) to ensure the LEB size is validated before use.

Affected products

  • Linux Linux Kernel up to and including 6.7.4

Timeline

  • 2024-01-24: patched: Initial fix committed to Linux kernel source
  • 2024-02-12: disclosed: CVE-2024-25739 published
  • 2024-06-25: advisory: Debian LTS advisory published

References

Related threats