In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quotagetnextquota. Specifically, sbdqinfo(sb, type)->dqi_priv is the dangling pointer.
During the remounting process, the pointer dqipriv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOTSUSPENDED flag instead of setting the DQUOTUSAGEENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2getnext_id is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqipriv to null when it is freed after remounting with read-only and put a check for DQUOTSUSPENDED in ocfs2getnext_id.
[akpm@linux-foundation.org: coding-style cleanups]
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-0997ba8d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f44e6d70c100614c211703f065cad448050e4a0e",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-10bf45f1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e3d203b1adede46bbba049e497765d67865be18",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-117576fa",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f3fd772d152229d94602bca243fbb658068a597",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-13c938cb",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f3fd772d152229d94602bca243fbb658068a597",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-1a77deee",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58f9e20e2a7602e1dd649a1ec4790077c251cb6c",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-2891bc8b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f44e6d70c100614c211703f065cad448050e4a0e",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-337ba80b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ff6f635a08c30559ded0c110c7ce03ba7747d11",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-4e1eac1a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ff6f635a08c30559ded0c110c7ce03ba7747d11",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-5736f476",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d431192486367eee03cc28d0b53b97dafcb8e63",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-6cad1824",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58f9e20e2a7602e1dd649a1ec4790077c251cb6c",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240629923651285624415899083155100151532",
"105301439096336093959717633244900116242",
"128727549081838396604065681157645189659",
"30018280469279393212515918523854131544"
]
},
"id": "CVE-2024-57892-7f2de414",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58f9e20e2a7602e1dd649a1ec4790077c251cb6c",
"target": {
"file": "fs/ocfs2/quota_local.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-9a02f885",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ff6f635a08c30559ded0c110c7ce03ba7747d11",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-b3fe8b1c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f44e6d70c100614c211703f065cad448050e4a0e",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-d2051457",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d431192486367eee03cc28d0b53b97dafcb8e63",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-db5785ea",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f3fd772d152229d94602bca243fbb658068a597",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1220.0,
"function_hash": "242406349322399181128402233231187156274"
},
"id": "CVE-2024-57892-ddbbda44",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e3d203b1adede46bbba049e497765d67865be18",
"target": {
"file": "fs/ocfs2/quota_local.c",
"function": "ocfs2_local_free_info"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-e3be7032",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e3d203b1adede46bbba049e497765d67865be18",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320744427714962675509740899784516147987",
"155582834533438779286428609937599021769",
"228830347490382943599766229393521483659",
"105713566594930092671119486342568561045"
]
},
"id": "CVE-2024-57892-f1d9b036",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d431192486367eee03cc28d0b53b97dafcb8e63",
"target": {
"file": "fs/ocfs2/quota_global.c"
}
}
]