Junglewise Threat Intelligence

CVE-2024-49884: Linux Kernel ext4 use-after-free in ext4_split_extent_at

CVE-2024-49884 · Severity: high · CVSS 7.8 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's ext4 file system, which is widely used for data storage on Linux-based servers and workstations. Under specific conditions involving memory pressure or disk errors, the system may attempt to access memory that has already been released. This can lead to system instability, data corruption, or potentially allow an attacker to gain elevated privileges on the system.

Technical details

A use-after-free (UAF) vulnerability exists in the ext4_split_extent_at() function within the Linux kernel's ext4 file system. The flaw is triggered when ext4_ext_insert_extent() fails due to memory allocation errors (-ENOMEM) or I/O errors (-EIO), causing the extent path to be freed and set to NULL. Subsequent code paths in ext4_split_extent_at() continue to access the freed 'path' pointer, specifically during calls to ext4_ext_dirty() or ext4_ext_show_leaf(). A local attacker could potentially exploit this to cause a kernel panic or achieve arbitrary code execution. The issue has been addressed by ensuring the path is updated via ext4_find_extent() before subsequent use.

Affected products

  • Linux Linux Kernel 3.18 to 4.19.323, 4.20 to 5.4.290, 5.5 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3

Timeline

  • 2024-08-22: patched: Initial patch authored by Baokun Li
  • 2024-10-21: disclosed: CVE published in NVD

References

Related threats