In the Linux kernel, the following vulnerability has been resolved:
ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->eh_entries) is non-zero when depth is > 0. And this will lead to problems because the EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:
[ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] <TASK> [ 135.279247] ? preempt_count_add+0x6d/0xa0 [ 135.280358] ? percpu_counter_add_batch+0x55/0xb0 [ 135.281612] ? _raw_read_unlock+0x18/0x30 [ 135.282704] ext4_map_blocks+0x294/0x5a0 [ 135.283745] ? xa_load+0x6f/0xa0 [ 135.284562] ext4_mpage_readpages+0x3d6/0x770 [ 135.285646] read_pages+0x67/0x1d0 [ 135.286492] ? folio_add_lru+0x51/0x80 [ 135.287441] page_cache_ra_unbounded+0x124/0x170 [ 135.288510] filemap_get_pages+0x23d/0x5a0 [ 135.289457] ? path_openat+0xa72/0xdd0 [ 135.290332] filemap_read+0xbf/0x300 [ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40 [ 135.292192] new_sync_read+0x103/0x170 [ 135.293014] vfs_read+0x15d/0x180 [ 135.293745] ksys_read+0xa1/0xe0 [ 135.294461] do_syscall_64+0x3c/0x80 [ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0
This patch simply adds an extra check in __ext4_ext_check(), verifying that eh_entries is not 0 when eh_depth is > 0.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.147-133.644Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.15.73-48.135Upgrade python-perfUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perf | Aug 2, 2024 | Apr 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Jul 17, 2024 | Apr 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade dtb-exynosUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatchUpgrade kernel-rtUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade kselftests-kmp-azureUpgrade kernel-preemptUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade gfs2-kmp-defaultUpgrade dtb-qcomUpgrade dtb-appleUpgrade gfs2-kmp-rtUpgrade kernel-preempt-develUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-sourceUpgrade dtb-freescaleUpgrade kernel-64kbUpgrade dtb-caviumUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade kernel-64kb-optionalUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-develUpgrade dtb-marvellUpgrade kernel-rt_debug-develUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade dtb-hisiliconUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-default-vdsoUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade dtb-apmUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade dtb-socionextUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade dtb-amdUpgrade kernel-devel-rtUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-64kb-extra | Aug 9, 2024 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-raspiUpgrade linuxUpgrade linux-azure-fdeUpgrade linux-aws-5.15Upgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-aws-5.4Upgrade linux-azure-fipsUpgrade linux-azure-fde-5.15Upgrade linux-hwe-5.15Upgrade linux-ibm-5.4Upgrade linux-aws-fipsUpgrade linux-realtimeUpgrade linux-awsUpgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-azureUpgrade linux-gkeop-5.15Upgrade linux-hwe-5.4Upgrade linux-iotUpgrade linux-azure-5.4Upgrade linux-gcp-5.4Upgrade linux-intel-iotgUpgrade linux-gcpUpgrade linux-oracle-5.15Upgrade linux-raspi-5.4Upgrade linux-gcp-5.15Upgrade linux-azure-5.15Upgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-nvidiaUpgrade linux-gkeUpgrade linux-kvmUpgrade linux-oracleUpgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linux-lowlatency-hwe-5.15 | Nov 19, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub