CVE-2024-49883

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: aovid use-after-free in ext4_ext_insert_extent()

As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is

reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and

cause UAF. Below is a sample trace with dummy values:

ext4_ext_insert_extent

path = *ppath = 2000

ext4_ext_create_new_leaf(ppath)

ext4_find_extent(ppath)

path = *ppath = 2000

if (depth > path[0].p_maxdepth)

kfree(path = 2000);

*ppath = path = NULL;

path = kcalloc() = 3000

*ppath = 3000;

return path;

/* here path is still 2000, UAF! */

eh = path[depth].p_hdr

==================================================================

BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330

Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179

CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866

Call Trace:

<TASK>

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References