CVE-2024-49966 ocfs2: cancel dqi_sync_work before freeing oinfo
A use-after-free vulnerability in the Linux kernel OCFS2 filesystem can cause a system crash when error handling frees active work items.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49966?
CVE-2024-49966 is a high-severity use after free vulnerability in Debian Debian Linux, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: cancel dqi_sync_work before freeing oinfo
ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:
ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c
This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails.
Weakness: CWE-416
Which versions are affected by CVE-2024-49966?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-49966?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-49966 being exploited?
There is no known exploitation of CVE-2024-49966 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-49966, DEBIAN-CVE-2024-49966, GHSA-w8mx-fc3q-r9qv, UBUNTU-CVE-2024-49966.