CVE-2024-41054: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-41054 affects the Linux kernel's SCSI UFS core component, specifically related to a race condition in the ufshcd_clear_cmd function. The vulnerability was discovered in Linux kernel versions from 6.5 up to (excluding) 6.6.41 and from 6.7 up to (excluding) 6.9.10. The issue was disclosed on July 29, 2024, and has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) (NVD).

The vulnerability occurs due to a race condition between ufshcd_clear_cmd and the completion ISR (Interrupt Service Routine). When the race condition occurs, the completed tag of the request's mq_hctx pointer is set to NULL by the ISR, causing ufshcd_clear_cmd's call to ufshcd_mcq_req_to_hwq to trigger a NULL pointer kernel error. The issue stems from improper handling of request completion timing in the UFS driver (Kernel Patch).

The vulnerability can lead to a NULL pointer dereference in the kernel, potentially causing a system crash or denial of service condition. This affects systems using the Universal Flash Storage (UFS) subsystem in the Linux kernel (NVD).

The vulnerability requires local access to the system and can be triggered through the UFS subsystem. The CVSS metrics indicate a low attack complexity (AC:L) and require low privileges (PR:L), with no user interaction needed (UI:N) (NVD).

The issue has been fixed in the Linux kernel through patches that modify the ufshcd_mcq_req_to_hwq function to properly handle cases where the request has already been freed. The fix returns success when the request is completed by ISR since the submission queue does not need cleanup in such cases. Users should update to Linux kernel versions 6.6.41 or later, or 6.9.10 or later, depending on their kernel series (Kernel Patch).