| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-49881: ext4: update orig_path in ext4_find_extent() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: update orig_path in ext4_find_extent() |
| |
| In ext4_find_extent(), if the path is not big enough, we free it and set |
| *orig_path to NULL. But after reallocating and successfully initializing |
| the path, we don't update *orig_path, in which case the caller gets a |
| valid path but a NULL ppath, and this may cause a NULL pointer dereference |
| or a path memory leak. For example: |
| |
| ext4_split_extent |
| path = *ppath = 2000 |
| ext4_find_extent |
| if (depth > path[0].p_maxdepth) |
| kfree(path = 2000); |
| *orig_path = path = NULL; |
| path = kcalloc() = 3000 |
| ext4_split_extent_at(*ppath = NULL) |
| path = *ppath; |
| ex = path[depth].p_ext; |
| // NULL pointer dereference! |
| |
| ================================================================== |
| BUG: kernel NULL pointer dereference, address: 0000000000000010 |
| CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847 |
| RIP: 0010:ext4_split_extent_at+0x6d/0x560 |
| Call Trace: |
| <TASK> |
| ext4_split_extent.isra.0+0xcb/0x1b0 |
| ext4_ext_convert_to_initialized+0x168/0x6c0 |
| ext4_ext_handle_unwritten_extents+0x325/0x4d0 |
| ext4_ext_map_blocks+0x520/0xdb0 |
| ext4_map_blocks+0x2b0/0x690 |
| ext4_iomap_begin+0x20e/0x2c0 |
| [...] |
| ================================================================== |
| |
| Therefore, *orig_path is updated when the extent lookup succeeds, so that |
| the caller can safely use path or *ppath. |
| |
| The Linux kernel CVE team has assigned CVE-2024-49881 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 4.19.323 with commit ec0c0beb9b777cdd1edd7df9b36e0f3e67e2bdff |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 5.10.227 with commit 6766937d0327000ac1b87c97bbecdd28b0dd6599 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 5.15.168 with commit a9fcb1717d75061d3653ed69365c8d45331815cd |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.1.113 with commit 6801ed1298204d16a38571091e31178bfdc3c679 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.6.55 with commit f55ecc58d07a6c1f6d6d5b5af125c25f8da0bda2 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.10.14 with commit b63481b3a388ee2df9e295f97273226140422a42 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.11.3 with commit 11b230100d6801c014fab2afabc8bdea304c1b96 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.12 with commit 5b4b2dcace35f618fe361a87bae6f0d13af31bc1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-49881 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/extents.c |
| fs/ext4/move_extent.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ec0c0beb9b777cdd1edd7df9b36e0f3e67e2bdff |
| https://git.kernel.org/stable/c/6766937d0327000ac1b87c97bbecdd28b0dd6599 |
| https://git.kernel.org/stable/c/a9fcb1717d75061d3653ed69365c8d45331815cd |
| https://git.kernel.org/stable/c/6801ed1298204d16a38571091e31178bfdc3c679 |
| https://git.kernel.org/stable/c/f55ecc58d07a6c1f6d6d5b5af125c25f8da0bda2 |
| https://git.kernel.org/stable/c/b63481b3a388ee2df9e295f97273226140422a42 |
| https://git.kernel.org/stable/c/11b230100d6801c014fab2afabc8bdea304c1b96 |
| https://git.kernel.org/stable/c/5b4b2dcace35f618fe361a87bae6f0d13af31bc1 |
