CVE-2024-36478: 
Linux Kernel vulnerability analysis and mitigation

A null pointer dereference vulnerability was discovered in the Linux kernel's null_blk driver when configuring 'power' and 'submit_queues' parameters concurrently. The vulnerability, tracked as CVE-2024-36478, affects the Linux kernel's block layer subsystem and was fixed in June 2024 (Kernel Git).

The vulnerability occurs due to a race condition between del_gendisk() and blk_mq_update_nr_hw_queues() functions. When 'power' and 'submit_queues' are configured concurrently, it can lead to a null pointer dereference, causing a kernel panic. The issue manifests when dev->nullb is accessed after being set to NULL during device deletion (Kernel Git).

When exploited, this vulnerability can cause a denial of service condition through a kernel panic, affecting system stability and availability. The issue can be triggered by local users with access to configure the null_blk driver parameters (Ubuntu Security).

The vulnerability can be triggered using a simple test script that concurrently modifies the 'power' and 'submit_queues' parameters through the sysfs interface. The exploit requires local access to the system and the ability to load and configure the null_blk kernel module (Kernel Git).

The vulnerability has been fixed by implementing proper mutex locking to protect nullb_device_power_store() and nullb_update_nr_hw_queues() functions from concurrent access. The fix was implemented in the Linux kernel and is available through distribution updates (NVD).