| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-49960: ext4: fix timer use-after-free on failed mount |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: fix timer use-after-free on failed mount |
| |
| Syzbot has found an ODEBUG bug in ext4_fill_super |
| |
| The del_timer_sync function cancels the s_err_report timer, |
| which reminds about filesystem errors daily. We should |
| guarantee the timer is no longer active before kfree(sbi). |
| |
| When filesystem mounting fails, the flow goes to failed_mount3, |
| where an error occurs when ext4_stop_mmpd is called, causing |
| a read I/O failure. This triggers the ext4_handle_error function |
| that ultimately re-arms the timer, |
| leaving the s_err_report timer active before kfree(sbi) is called. |
| |
| Fix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd. |
| |
| The Linux kernel CVE team has assigned CVE-2024-49960 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.10.51 with commit 5e4f5138bd8522ebe231a137682d3857209a2c07 and fixed in 5.10.237 with commit 7aac0c17a8cdf4a3236991c1e60435c6a984076c |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 5.15.181 with commit 22e9b83f0f33bc5a7a3181769d1dccbf021f5b04 |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 6.1.118 with commit cf3196e5e2f36cd80dab91ffae402e13935724bc |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 6.6.55 with commit 9203817ba46ebba7c865c8de2aba399537b6e891 |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 6.10.14 with commit fa78fb51d396f4f2f80f8e96a3b1516f394258be |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 6.11.3 with commit b85569585d0154d4db1e4f9e3e6a4731d407feb0 |
| Issue introduced in 5.14 with commit 618f003199c6188e01472b03cdbba227f1dc5f24 and fixed in 6.12 with commit 0ce160c5bdb67081a62293028dc85758a8efb22a |
| Issue introduced in 5.12.18 with commit cecfdb9cf9a700d1037066173abac0617f6788df |
| Issue introduced in 5.13.3 with commit eb7b40d9d3785f7a131fb0b1f89bb6efa46c1833 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-49960 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/super.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7aac0c17a8cdf4a3236991c1e60435c6a984076c |
| https://git.kernel.org/stable/c/22e9b83f0f33bc5a7a3181769d1dccbf021f5b04 |
| https://git.kernel.org/stable/c/cf3196e5e2f36cd80dab91ffae402e13935724bc |
| https://git.kernel.org/stable/c/9203817ba46ebba7c865c8de2aba399537b6e891 |
| https://git.kernel.org/stable/c/fa78fb51d396f4f2f80f8e96a3b1516f394258be |
| https://git.kernel.org/stable/c/b85569585d0154d4db1e4f9e3e6a4731d407feb0 |
| https://git.kernel.org/stable/c/0ce160c5bdb67081a62293028dc85758a8efb22a |
