CVE-2024-49882

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix double brelse() the buffer of the extents path

In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been

released, otherwise it may be released twice. An example of what triggers

this is as follows:

split2 map split1

|--------|-------|--------|

ext4_ext_map_blocks

ext4_ext_handle_unwritten_extents

ext4_split_convert_extents

// path->p_depth == 0

ext4_split_extent

// 1. do split1

ext4_split_extent_at

|ext4_ext_insert_extent

| ext4_ext_create_new_leaf

| ext4_ext_grow_indepth

| le16_add_cpu(&neh->eh_depth, 1)

| ext4_find_extent

| // return -ENOMEM

|// get error and try zeroout

|path = ext4_find_extent

| path->p_depth = 1

|ext4_ext_try_to_merge

| ext4_ext_try_to_merge_up

| path->p_depth = 0

| brelse(path[1].p_bh) ---> not set to NULL here

|// ze

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References