ublk PartitionScan UAF

Vulnerability analysis

Root Cause: A race condition exists between the asynchronous partition scan worker (ublk_partition_scan_work) and device teardown (ublk_stop_dev). The teardown path calls del_gendisk(), sets ub->ub_disk to NULL via ublk_detach_disk(), and calls put_disk() which may free the disk structure. Meanwhile, the partition scan worker can still be running and attempts to dereference ub->ub_disk, leading to a use-after-free vulnerability.

Attack Surface: This is a local vulnerability requiring access to the ublk block device subsystem. An attacker would need the ability to create and manipulate ublk devices, which typically requires elevated privileges or specific device access permissions. The race condition can be triggered through normal device lifecycle operations (start/stop) making it potentially exploitable during legitimate device management.

Fix Mechanism: The fix implements proper reference counting by: 1) Moving the partition scan worker function to use ublk_get_disk()/ublk_put_disk() to hold a reference to the disk during the scan operation, 2) Adding spinlock synchronization in ublk_get_disk() with ublk_detach_disk() to ensure the worker either gets a valid reference or sees NULL and exits early, 3) Changing flush_work() to cancel_work_sync() in the teardown path to prevent unnecessary execution of the partition scan when the disk is already detached.