In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid use-after-free in ext4extshow_leaf()
In ext4findextent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:
ext4splitextent path = *ppath; ext4splitextentat(ppath) path = ext4findextent(ppath) ext4splitextentat(ppath) // ext4findextent fails to free path // but zeroout succeeds ext4extshowleaf(inode, path) eh = path[depth].phdr // path use-after-free !!!
Similar to ext4splitextentat(), we use *ppath directly as an input to ext4extshowleaf(). Fix a spelling error by the way.
Same problem in ext4exthandleunwrittenextents(). Since 'path' is only used in ext4extshow_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.
[
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1490.0,
"function_hash": "178590969921064889313255492151787347449"
},
"id": "CVE-2024-49889-07e33c91",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b114f2cc7dd5d36729d040b68432fbd0f0a8868",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-21ec02f8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eba3b0cc5b8de624918d21f32b5b8db59a90b39",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-313e964e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4999fed877bb64e3e7f9ab9996de2ca983c41928",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-3d999305",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b114f2cc7dd5d36729d040b68432fbd0f0a8868",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-3f1b7d63",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d483c7cc1796bd6a80e7b3a8fd494996260f6b67",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-55236fd6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4999fed877bb64e3e7f9ab9996de2ca983c41928",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-5a64189f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0cb4561fc4284d04e69c8a66c8504928ab2484e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-6f1dabac",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b114f2cc7dd5d36729d040b68432fbd0f0a8868",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-760ba38d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0cb4561fc4284d04e69c8a66c8504928ab2484e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1490.0,
"function_hash": "178590969921064889313255492151787347449"
},
"id": "CVE-2024-49889-78f2dcba",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d483c7cc1796bd6a80e7b3a8fd494996260f6b67",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1500.0,
"function_hash": "313511076965396654006551742821007758151"
},
"id": "CVE-2024-49889-8009878d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0cb4561fc4284d04e69c8a66c8504928ab2484e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-80c73625",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eba3b0cc5b8de624918d21f32b5b8db59a90b39",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1490.0,
"function_hash": "178590969921064889313255492151787347449"
},
"id": "CVE-2024-49889-96529023",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b2096380ba475771971a778a478661a791aa15",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1500.0,
"function_hash": "313511076965396654006551742821007758151"
},
"id": "CVE-2024-49889-bb893247",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4999fed877bb64e3e7f9ab9996de2ca983c41928",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-c324a9e8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b2096380ba475771971a778a478661a791aa15",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_split_extent"
},
"digest": {
"length": 1490.0,
"function_hash": "178590969921064889313255492151787347449"
},
"id": "CVE-2024-49889-c4639c9c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eba3b0cc5b8de624918d21f32b5b8db59a90b39",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_handle_unwritten_extents"
},
"digest": {
"length": 1773.0,
"function_hash": "109250608706781797250278736257789916"
},
"id": "CVE-2024-49889-c5cd9c7d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b2096380ba475771971a778a478661a791aa15",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/ext4/extents.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"313454652235873171922280038215753334907",
"212018855463289861791932814839473316944",
"27267293264855027112210203745035503817",
"187325958869978758998506201490975516710",
"337529735146719241043665001845563147100",
"2408351840351559880243664031121954603",
"76958530209563665651946219582612467029",
"207550170290119968241451101051105492296",
"113494688344421052200863826805893904494",
"109002655852037957216302341151813152007",
"236978049417658269209302784905406398373",
"204441584233409713593785929959169202199",
"248254297616168310442877387478807664537",
"283545010382697004606673596335608223587",
"2951429557365863589774348495613121931",
"183274220754547151639927132891062055425",
"87328396210680493485218020857851773934",
"222231968062212817108805208853641271132",
"230735330046379015320516579982683767743",
"313310180587172472645624613762918750198",
"7075149593281573003854403113832251104"
]
},
"id": "CVE-2024-49889-d1017e21",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d483c7cc1796bd6a80e7b3a8fd494996260f6b67",
"signature_version": "v1"
}
]