| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: aovid use-after-free in ext4_ext_insert_extent() |
| |
| As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is |
| reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and |
| cause UAF. Below is a sample trace with dummy values: |
| |
| ext4_ext_insert_extent |
| path = *ppath = 2000 |
| ext4_ext_create_new_leaf(ppath) |
| ext4_find_extent(ppath) |
| path = *ppath = 2000 |
| if (depth > path[0].p_maxdepth) |
| kfree(path = 2000); |
| *ppath = path = NULL; |
| path = kcalloc() = 3000 |
| *ppath = 3000; |
| return path; |
| /* here path is still 2000, UAF! */ |
| eh = path[depth].p_hdr |
| |
| ================================================================== |
| BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 |
| Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 |
| CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 |
| Call Trace: |
| <TASK> |
| ext4_ext_insert_extent+0x26d4/0x3330 |
| ext4_ext_map_blocks+0xe22/0x2d40 |
| ext4_map_blocks+0x71e/0x1700 |
| ext4_do_writepages+0x1290/0x2800 |
| [...] |
| |
| Allocated by task 179: |
| ext4_find_extent+0x81c/0x1f70 |
| ext4_ext_map_blocks+0x146/0x2d40 |
| ext4_map_blocks+0x71e/0x1700 |
| ext4_do_writepages+0x1290/0x2800 |
| ext4_writepages+0x26d/0x4e0 |
| do_writepages+0x175/0x700 |
| [...] |
| |
| Freed by task 179: |
| kfree+0xcb/0x240 |
| ext4_find_extent+0x7c0/0x1f70 |
| ext4_ext_insert_extent+0xa26/0x3330 |
| ext4_ext_map_blocks+0xe22/0x2d40 |
| ext4_map_blocks+0x71e/0x1700 |
| ext4_do_writepages+0x1290/0x2800 |
| ext4_writepages+0x26d/0x4e0 |
| do_writepages+0x175/0x700 |
| [...] |
| ================================================================== |
| |
| So use *ppath to update the path to avoid the above problem. |
| |
| The Linux kernel CVE team has assigned CVE-2024-49883 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 4.19.323 with commit e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 5.4.285 with commit 975ca06f3fd154c5f7742083e7b2574c57d1c0c3 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 5.10.227 with commit 5e811066c5ab709b070659197dccfb80ab650ddd |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 5.15.168 with commit 9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.1.113 with commit 51db04892a993cace63415be99848970a0f15ef2 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.6.55 with commit 8162ee5d94b8c0351be0a9321be134872a7654a1 |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.10.14 with commit beb7b66fb489041c50c6473100b383f7a51648fc |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.11.3 with commit bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b |
| Issue introduced in 3.18 with commit 10809df84a4d868db61af621bae3658494165279 and fixed in 6.12 with commit a164f3a432aae62ca23d03e6d926b122ee5b860d |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-49883 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/extents.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1 |
| https://git.kernel.org/stable/c/975ca06f3fd154c5f7742083e7b2574c57d1c0c3 |
| https://git.kernel.org/stable/c/5e811066c5ab709b070659197dccfb80ab650ddd |
| https://git.kernel.org/stable/c/9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a |
| https://git.kernel.org/stable/c/51db04892a993cace63415be99848970a0f15ef2 |
| https://git.kernel.org/stable/c/8162ee5d94b8c0351be0a9321be134872a7654a1 |
| https://git.kernel.org/stable/c/beb7b66fb489041c50c6473100b383f7a51648fc |
| https://git.kernel.org/stable/c/bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b |
| https://git.kernel.org/stable/c/a164f3a432aae62ca23d03e6d926b122ee5b860d |
