Junglewise Threat Intelligence

CVE-2024-26878: Linux Kernel NULL pointer dereference in quota subsystem

CVE-2024-26878 · Severity: medium · CVSS 4.7 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Linux kernel's disk quota system could allow a local user to crash the system. The quota system manages how much disk space users or groups can consume; an exploit of this flaw results in a 'NULL pointer dereference,' leading to a kernel panic and system unavailability. This affects the reliability and uptime of servers, particularly in multi-user environments.

Technical details

A race condition exists in fs/quota/dquot.c within the Linux kernel. The vulnerability is triggered when one process (e.g., dquot_free_inode) checks an inode's quota pointers while another process (e.g., quota_off) concurrently sets those pointers to NULL. If the first process validates the pointer as non-NULL but the second process clears it before the first process attempts to use it (such as during a spin_lock operation), a NULL pointer dereference occurs. This is a classic TOCTOU (Time-of-Check to Time-of-Use) bug. The fix involves using temporary pointers and proper SRCU dereferencing to ensure pointer stability during the operation. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel versions up to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-02-02: other: Patch submitted by developer
  • 2024-04-17: disclosed: CVE published

References

Related threats