vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-39276): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:C/I:N/A:N) | 06/25/2024 | 08/09/2024 | 02/20/2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
Syzbot reports a warning as follows:
============================================
WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290
Modules linked in:
CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7
RIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419
Call Trace:
ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375
generic_shutdown_super+0x136/0x2d0 fs/super.c:641
kill_block_super+0x44/0x90 fs/super.c:1675
ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327
[...]
============================================
This is because when finding an entry in ext4_xattr_block_cache_find(), if
ext4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown
in the __entry_find(), won't be put away, and eventually trigger the above
issue in mb_cache_destroy() due to reference count leakage.
So call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix.
Solution(s)
References
- CVE-2024-39276
- https://attackerkb.com/topics/CVE-2024-39276
- UBUNTU-USN-6951-1
- UBUNTU-USN-6951-2
- UBUNTU-USN-6951-3
- UBUNTU-USN-6951-4
- UBUNTU-USN-6953-1
- UBUNTU-USN-6979-1
- UBUNTU-USN-6999-1
- UBUNTU-USN-6999-2
- UBUNTU-USN-7004-1
- UBUNTU-USN-7005-1
- UBUNTU-USN-7005-2
- UBUNTU-USN-7007-1
- UBUNTU-USN-7007-2
- UBUNTU-USN-7007-3
- UBUNTU-USN-7008-1
- UBUNTU-USN-7009-1
- UBUNTU-USN-7009-2
- UBUNTU-USN-7019-1
- UBUNTU-USN-7029-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.