vulnerability
Debian: CVE-2024-53184: linux, linux-6.1 -- security update
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | 2024-12-27 | 2025-01-13 | 2025-03-05 |
Description
In the Linux kernel, the following vulnerability has been resolved:
um: ubd: Do not use drvdata in release
The drvdata is not available in release. Let's just use container_of()
to get the ubd instance. Otherwise, removing a ubd device will result
in a crash:
RIP: 0033:blk_mq_free_tag_set+0x1f/0xba
RSP: 00000000e2083bf0 EFLAGS: 00010246
RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00
RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348
RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7
R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000
R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0
Kernel panic - not syncing: Segfault with no mm
CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1
Workqueue: events mc_work_proc
Stack:
00000000 604f7ef0 62c5d000 62405d20
e2083c30 6002c776 6002c755 600e47ff
e2083c60 6025ffe3 04208060 603d36e0
Call Trace:
[] ubd_device_release+0x21/0x55
[] ? ubd_device_release+0x0/0x55
[] ? kfree+0x0/0x100
[] device_release+0x70/0xba
[] kobject_put+0xb5/0xe2
[] put_device+0x19/0x1c
[] platform_device_put+0x26/0x29
[] platform_device_unregister+0x2c/0x2e
[] ubd_remove+0xb8/0xd6
[] ? mconsole_reply+0x0/0x50
[] mconsole_remove+0x160/0x1cc
[] ? mconsole_reply+0x48/0x50
[] ? um_set_signals+0x3b/0x43
[] ? update_min_vruntime+0x14/0x70
[] ? dequeue_task_fair+0x164/0x235
[] ? update_cfs_group+0x0/0x40
[] ? __schedule+0x0/0x3ed
[ [] mc_work_proc+0x77/0x91
[] process_scheduled_works+0x1af/0x2c3
[] ? assign_work+0x0/0x58
[] worker_thread+0x2f7/0x37a
[] ? set_pf_worker+0x0/0x64
[] ? arch_local_irq_save+0x0/0x2d
[] ? kthread_exit+0x0/0x3a
[] ? worker_thread+0x0/0x37a
[] kthread+0x130/0x135
[] new_thread_handler+0x85/0xb6
Solution(s)

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.