CVE-2023-54087

Root

Cause

In the Linux kernel's UBI (Unsorted Block Images) subsystem, the function ubi_free_volume() can be called during error handling when ubi_add_volume() fails. Specifically, if calling cdev_add() or device_register() within ubi_add_volume() may fail, leading to a call to kill_volumes(), which iterates over volumes and calls ubi_free_volume() on each. However, if a volume was not successfully added (e.g., device_register() was never called), ubi_free_volume() still attempts to call cdev_del() and and device_unregister() on that volume, resulting in a null-pointer dereference [1][2][3].

Exploitation

An attacker would need to trigger a failure in the UBI volume creation path, for example by exhausting system resources or causing a race condition that makes cdev_add() or device_register() fail. This requires local access to the system and the ability to manipulate UBI volumes (e.g., via ubiattach or ubimkexec). No special privileges are not strictly required if the attacker can create and then cause a failure in volume creation, but typical scenarios involve a local user with access to UBI control interfaces.

Impact

A successful exploitation leads to a kernel crash (denial of service) due to a null-pointer dereference. This can cause system instability or a complete system hang, requiring a reboot. There is no evidence of privilege escalation or data corruption beyond the immediate crash.

Mitigation

The fix, committed in the Linux kernel stable tree, ensures that when ubi_add_volume() fails, the corresponding volume pointer is set to NULL so that kill_volumes() and subsequent ubi_free_volume() calls skip the uninitialized volume. Additionally, resources are properly released in the error path of ubi_add_volume() [1][2][3]. Users should apply the latest stable kernel updates to remediate this vulnerability.