Linux Kernel Ublk Driver Queue Recovery Interruption Vulnerability

A vulnerability in the Linux kernel's ublk driver has been addressed. The issue arose in the 'ublk_ctrl_end_recovery()' function, where the 'wait_for_completion_interruptible()' call could be interrupted by a signal before the queues were fully set up. This interruption could lead to an incomplete recovery process, causing a kernel oops error. The vulnerability has been fixed by ensuring that the recovery command is properly terminated if the completion wait is interrupted.

Impact

The vulnerability could cause a kernel oops, leading to a system crash or instability.

Reproduction

The vulnerability can be reproduced by sending a signal to a process that is in the 'ublk_ctrl_end_recovery()' function, before the queue setup is complete. This interruption will cause the recovery process to fail, but without properly signaling the end of the recovery command, which can then trigger a kernel oops error.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.