CVE-2024-49881

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: update orig_path in ext4_find_extent()

In ext4_find_extent(), if the path is not big enough, we free it and set

*orig_path to NULL. But after reallocating and successfully initializing

the path, we don't update *orig_path, in which case the caller gets a

valid path but a NULL ppath, and this may cause a NULL pointer dereference

or a path memory leak. For example:

ext4_split_extent

path = *ppath = 2000

ext4_find_extent

if (depth > path[0].p_maxdepth)

kfree(path = 2000);

*orig_path = path = NULL;

path = kcalloc() = 3000

ext4_split_extent_at(*ppath = NULL)

path = *ppath;

ex = path[depth].p_ext;

// NULL pointer dereference!

==================================================================

BUG: kernel NULL pointer dereference, address: 0000000000000010

CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847

RIP: 0010:ext4_split_extent_at+0x6d/0x560

Call Trac

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References