CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49882

CVE-2024-49882 : In the Linux kernel’s ext4 code, a double free/UAF issue was fixed in ext4_ext_try_to_merge_up() where path[1].p_bh could be freed twice if not NULL after release. The problem manifested as a warning “brelse a buffer twice” during writeback when ext4 extents were merged and buffe...

CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49883

In CVE-2024-49883, the Linux kernel ext4 ext4_ext_insert_extent() is vulnerable to use-after-free when a path is reallocated in ext4_ext_create_new_leaf(), leaving a stale path in ext4_ext_insert_extent() and triggering UAF (KASAN) during map/write paths. The issue is reproduced via a realloc of ...

CVE-2024-49881

In CVE-2024-49881, the Linux kernel ext4 caller path handling was fixed: in ext4_find_extent(), if a path is reallocated after being freed when depth exceeds path[0].p_maxdepth, orig_path was not updated, leaving the caller with a valid path but a NULL ppath. This could cause a NULL pointer deref...

CVE-2024-49881 ext4: update orig_path in ext4_find_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: update origpath in ext4findextent In ext4findextent, if the path is not big enough, we free it and set origpath to NULL. But after reallocating and successfully initializing the path, we don't update origpath, in which case...

CVE-2024-49881 ext4: update orig_path in ext4_find_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: update origpath in ext4findextent In ext4findextent, if the path is not big enough, we free it and set origpath to NULL. But after reallocating and successfully initializing the path, we don't update origpath, in which case...

CVE-2024-49880 ext4: fix off by one issue in alloc_flex_gd()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in allocflexgd Wesley reported an issue: ================================================================== EXT4-fs dm-5: resizing filesystem from 7168 to 786432 blocks ------------ cut here -----------...

CVE-2024-49880

The CVE-2024-49880 entry concerns an off-by-one in ext4 resizing logic (alloc_flex_gd) leading to a kernel BUG in resize operations (resize2fs) when resizing a filesystem. The vulnerability is addressed by a patch that removes the problematic +1 (and adds a WARN_ON_ONCE) to ensure flex_gd->res...

CVE-2024-49880 ext4: fix off by one issue in alloc_flex_gd()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in allocflexgd Wesley reported an issue: ================================================================== EXT4-fs dm-5: resizing filesystem from 7168 to 786432 blocks ------------ cut here -----------...

CVE-2024-49880 ext4: fix off by one issue in alloc_flex_gd()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in allocflexgd Wesley reported an issue: ================================================================== EXT4-fs dm-5: resizing filesystem from 7168 to 786432 blocks ------------ cut here -----------...

CVE-2024-49875

CVE-2024-49875 affects the Linux kernel. Affected component: nfsd path within the kernel’s VFS stack handling EBADMSG from ext4 readdir leading to a warning and non-standard errno. The fixed behavior maps EBADMSG to nfserr_io to avoid the warning, alleviating the -EBADMSG warning/ERR_PTR(-EFSBADC...

CVE-2024-49870 cachefiles: fix dentry leak in cachefiles_open_file()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix dentry leak in cachefilesopenfile A dentry leak may be caused when a lookup cookie and a cull are concurrent: P1 | P2 ----------------------------------------------------------- cachefileslookupcookie...

SUSE CVE-2024-47689

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to don't set SBRDONLY in f2fshandlecriticalerror syzbot reports a f2fs bug as below: ------------ cut here ------------ WARNING: CPU: 1 PID: 58 at kernel/rcu/sync.c:177 rcusyncdtor+0xcd/0x180 kernel/rcu/sync.c:177 CPU: ...

SUSE CVE-2024-47700

In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in ext4fillsuper if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where...

SUSE CVE-2024-47701

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an entry in an inlined directory, if evalueoffs is changed underneath the filesystem by some change in the block device, it will lead to...