CVE-2024-49889
Linux Kernel Ext4 Use-After-Free Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.
INFO
Published Date :
Oct. 21, 2024, 6:15 p.m.
Last Modified :
Oct. 25, 2024, 2:37 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-49889.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-49889 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-49889 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 25, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://git.kernel.org/stable/c/2eba3b0cc5b8de624918d21f32b5b8db59a90b39 No Types Assigned https://git.kernel.org/stable/c/2eba3b0cc5b8de624918d21f32b5b8db59a90b39 Patch Changed Reference Type https://git.kernel.org/stable/c/34b2096380ba475771971a778a478661a791aa15 No Types Assigned https://git.kernel.org/stable/c/34b2096380ba475771971a778a478661a791aa15 Patch Changed Reference Type https://git.kernel.org/stable/c/4999fed877bb64e3e7f9ab9996de2ca983c41928 No Types Assigned https://git.kernel.org/stable/c/4999fed877bb64e3e7f9ab9996de2ca983c41928 Patch Changed Reference Type https://git.kernel.org/stable/c/4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 No Types Assigned https://git.kernel.org/stable/c/4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 Patch Changed Reference Type https://git.kernel.org/stable/c/8b114f2cc7dd5d36729d040b68432fbd0f0a8868 No Types Assigned https://git.kernel.org/stable/c/8b114f2cc7dd5d36729d040b68432fbd0f0a8868 Patch Changed Reference Type https://git.kernel.org/stable/c/b0cb4561fc4284d04e69c8a66c8504928ab2484e No Types Assigned https://git.kernel.org/stable/c/b0cb4561fc4284d04e69c8a66c8504928ab2484e Patch Changed Reference Type https://git.kernel.org/stable/c/d483c7cc1796bd6a80e7b3a8fd494996260f6b67 No Types Assigned https://git.kernel.org/stable/c/d483c7cc1796bd6a80e7b3a8fd494996260f6b67 Patch Added CWE NIST CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.10.227 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.113 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.55 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11 up to (excluding) 6.11.3 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Added Reference kernel.org https://git.kernel.org/stable/c/b0cb4561fc4284d04e69c8a66c8504928ab2484e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4999fed877bb64e3e7f9ab9996de2ca983c41928 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2eba3b0cc5b8de624918d21f32b5b8db59a90b39 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/34b2096380ba475771971a778a478661a791aa15 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/8b114f2cc7dd5d36729d040b68432fbd0f0a8868 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d483c7cc1796bd6a80e7b3a8fd494996260f6b67 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-49889 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-49889
weaknesses.