CVE-2024-49889

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-49889
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49889.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-49889
Downstream
Related
Published
2024-10-21T18:15:11Z
Modified
2025-08-09T19:01:26Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid use-after-free in ext4extshow_leaf()

In ext4findextent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:

ext4splitextent path = *ppath; ext4splitextentat(ppath) path = ext4findextent(ppath) ext4splitextentat(ppath) // ext4findextent fails to free path // but zeroout succeeds ext4extshowleaf(inode, path) eh = path[depth].phdr // path use-after-free !!!

Similar to ext4splitextentat(), we use *ppath directly as an input to ext4extshowleaf(). Fix a spelling error by the way.

Same problem in ext4exthandleunwrittenextents(). Since 'path' is only used in ext4extshow_leaf(), remove 'path' and use *ppath directly.

This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.

References

Affected packages