In the Linux kernel, the following vulnerability has been resolved:
ublk: check import_ubuf() return value
import_ubuf() can fail if the address range (provided by the userspace
ublk server) is outside the allowed user address space. Return that 0
bytes were copied if import_ubuf() fails rather than passing an
uninitialized struct iov_iter to ublk_copy_user_pages().
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7
416baaa9-dc9f-4396-8d5f-8c081fb06d67