CVE-2024-49983 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
A double-free vulnerability in the Linux kernel ext4 filesystem allows attackers to cause denial of service or potentially execute code via crafted filesystem operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49983?
CVE-2024-49983 is a high-severity use after free vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process:
ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(&ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!!
So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4_find_extent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4_find_extent() instead of using strange error codes.
Weakness: CWE-415
Which versions are affected by CVE-2024-49983?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49983?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-49983 being exploited?
There is no known exploitation of CVE-2024-49983 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-51843, BELL-CVE-2024-49983, DEBIAN-CVE-2024-49983, GHSA-24gv-qfv8-v7f5, UBUNTU-CVE-2024-49983.