Executive brief
A vulnerability in the Linux kernel's ext4 file system could allow a local user to cause file system corruption. When using the Direct Access (DAX) feature, certain interrupted write operations can result in file metadata becoming inconsistent with the actual data stored on disk. This inconsistency can lead to system errors or require manual repair using file system check tools, potentially impacting system availability.
Technical details
A vulnerability exists in the ext4 DAX implementation within the Linux kernel where partial writes can cause extents to overflow beyond the inode size. In dax_iomap_rw(), if a process is killed (e.g., via a fatal signal) after blocks are mapped but before all data is copied, the inode size is updated based on the returned partial length, but the newly allocated extents remain at their full requested length. This discrepancy between i_size and the actual extent length causes file system consistency checks (fsck) to fail. The fix involves ensuring that extents are truncated if the final written length is smaller than the allocated space. This is a local vulnerability requiring the use of ext4 with DAX enabled.
Affected products
- Linux Linux Kernel 4.10 to 5.10.226, 5.11 to 5.15.167, 5.16 to 6.1.112, 6.2 to 6.6.54, 6.7 to 6.10.13, 6.11 to 6.11.2
Timeline
- 2024-10-21: advisory: CVE-2024-50015 published
- 2024-10-10: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/5efccdee4a7d507a483f20f880b809cc4eaef14d
- https://git.kernel.org/stable/c/8c30a9a8610c314554997f86370140746aa35661
- https://git.kernel.org/stable/c/a9f331f51515bdb3ebc8d0963131af367ef468f6
- https://git.kernel.org/stable/c/abfaa876b948baaea4d14f21a1963789845c8b4c
- https://git.kernel.org/stable/c/dda898d7ffe85931f9cca6d702a51f33717c501e
- https://git.kernel.org/stable/c/ec0dd451e236c46e4858d53e9e82bae7797a7af5
- https://git.kernel.org/stable/c/f8a7c342326f6ad1dfdb30a18dd013c70f5e9669