In the Linux kernel, the following vulnerability has been resolved:
ext4: aovid use-after-free in ext4extinsert_extent()
As Ojaswin mentioned in Link, in ext4extinsertextent(), if the path is reallocated in ext4extcreatenew_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values:
ext4extinsertextent path = *ppath = 2000 ext4extcreatenewleaf(ppath) ext4findextent(ppath) path = *ppath = 2000 if (depth > path[0].pmaxdepth) kfree(path = 2000); ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; / here path is still 2000, UAF! */ eh = path[depth].p_hdr
================================================================== BUG: KASAN: slab-use-after-free in ext4extinsertextent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4extinsertextent+0x26d4/0x3330 ext4extmapblocks+0xe22/0x2d40 ext4mapblocks+0x71e/0x1700 ext4do_writepages+0x1290/0x2800 [...]
Allocated by task 179: ext4findextent+0x81c/0x1f70 ext4extmapblocks+0x146/0x2d40 ext4mapblocks+0x71e/0x1700 ext4dowritepages+0x1290/0x2800 ext4writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...]
Freed by task 179: kfree+0xcb/0x240 ext4findextent+0x7c0/0x1f70 ext4extinsertextent+0xa26/0x3330 ext4extmapblocks+0xe22/0x2d40 ext4mapblocks+0x71e/0x1700 ext4dowritepages+0x1290/0x2800 ext4writepages+0x26d/0x4e0 dowritepages+0x175/0x700
So use *ppath to update the path to avoid the above problem.
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "fs/ext4/extents.c", "function": "ext4_ext_insert_extent" }, "id": "CVE-2024-49883-0d788384", "digest": { "length": 4782.0, "function_hash": "96560100177261666883170922920437076949" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8162ee5d94b8c0351be0a9321be134872a7654a1" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "fs/ext4/extents.c" }, "id": "CVE-2024-49883-45786759", "digest": { "line_hashes": [ "218644297217187729865043680555684588476", "335213282161407641415310172605115859460", "291469489384757052080287363534357594048", "73302966863329251587026726712991356295" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8162ee5d94b8c0351be0a9321be134872a7654a1" } ] }