CVE-2024-49960 ext4: fix timer use-after-free on failed mount

In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4fillsuper The deltimersync function cancels the serrreport timer, which reminds about filesystem errors daily. We should guarantee the timer is ...

CVE-2024-49960 ext4: fix timer use-after-free on failed mount

In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4fillsuper The deltimersync function cancels the serrreport timer, which reminds about filesystem errors daily. We should guarantee the timer is ...

CVE-2024-49889

CVE-2024-49889: Linux kernel ext4 uses-after-free in ext4_ext_show_leaf() and related ext4 extents handling. The issue arises when EXT_DEBUG is defined and a saved path pointer may be freed during extent handling, leading to use-after-free in ext4_ext_show_leaf() or during ext4_ext_handle unwritt...

CVE-2024-49889 ext4: avoid use-after-free in ext4_ext_show_leaf()

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4extshowleaf In ext4findextent, path may be freed by error or be reallocated, so using a previously saved ppath may have been freed and thus may trigger use-after-free, as follows: ext4splitextent...

CVE-2024-49889 ext4: avoid use-after-free in ext4_ext_show_leaf()

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4extshowleaf In ext4findextent, path may be freed by error or be reallocated, so using a previously saved ppath may have been freed and thus may trigger use-after-free, as follows: ext4splitextent...

CVE-2024-49884 ext4: fix slab-use-after-free in ext4_split_extent_at()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4splitextentat We hit the following use-after-free: ================================================================== BUG: KASAN: slab-use-after-free in ext4splitextentat+0xba8/0xcc0 Read of...

CVE-2024-49884

CVE-2024-49884 : Linux kernel ext4 slab-use-after-free in ext4_split_extent_at() during unwritten/extents handling. The issue stems from use-after-free of path data (path) when updating extents after an error (-ENOMEM/-EIO). The connected Astra Linux and kernel notes describe the root cause chain...

CVE-2024-49884 ext4: fix slab-use-after-free in ext4_split_extent_at()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4splitextentat We hit the following use-after-free: ================================================================== BUG: KASAN: slab-use-after-free in ext4splitextentat+0xba8/0xcc0 Read of...

CVE-2024-49883

In CVE-2024-49883, the Linux kernel ext4 ext4_ext_insert_extent() is vulnerable to use-after-free when a path is reallocated in ext4_ext_create_new_leaf(), leaving a stale path in ext4_ext_insert_extent() and triggering UAF (KASAN) during map/write paths. The issue is reproduced via a realloc of ...

CVE-2024-49882

CVE-2024-49882 : In the Linux kernel’s ext4 code, a double free/UAF issue was fixed in ext4_ext_try_to_merge_up() where path[1].p_bh could be freed twice if not NULL after release. The problem manifested as a warning “brelse a buffer twice” during writeback when ext4 extents were merged and buffe...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49883 ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in ext4extinsertextent, if the path is reallocated in ext4extcreatenewleaf, we'll use the stale path and cause UAF. Below is a sample trace with dumm...

CVE-2024-49882 ext4: fix double brelse() the buffer of the extents path

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse the buffer of the extents path In ext4exttrytomergeup, set path1.pbh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split...

CVE-2024-49881

In CVE-2024-49881, the Linux kernel ext4 caller path handling was fixed: in ext4_find_extent(), if a path is reallocated after being freed when depth exceeds path[0].p_maxdepth, orig_path was not updated, leaving the caller with a valid path but a NULL ppath. This could cause a NULL pointer deref...

CVE-2024-49881 ext4: update orig_path in ext4_find_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: update origpath in ext4findextent In ext4findextent, if the path is not big enough, we free it and set origpath to NULL. But after reallocating and successfully initializing the path, we don't update origpath, in which case...

CVE-2024-49881 ext4: update orig_path in ext4_find_extent()

In the Linux kernel, the following vulnerability has been resolved: ext4: update origpath in ext4findextent In ext4findextent, if the path is not big enough, we free it and set origpath to NULL. But after reallocating and successfully initializing the path, we don't update origpath, in which case...

CVE-2024-49880 ext4: fix off by one issue in alloc_flex_gd()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in allocflexgd Wesley reported an issue: ================================================================== EXT4-fs dm-5: resizing filesystem from 7168 to 786432 blocks ------------ cut here -----------...