vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-49889): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
7 | (AV:L/AC:L/Au:S/C:C/I:C/A:C) | Oct 21, 2024 | Dec 18, 2024 | Apr 29, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid use-after-free in ext4_ext_show_leaf()
In ext4_find_extent(), path may be freed by error or be reallocated, so
using a previously saved *ppath may have been freed and thus may trigger
use-after-free, as follows:
ext4_split_extent
path = *ppath;
ext4_split_extent_at(ppath)
path = ext4_find_extent(ppath)
ext4_split_extent_at(ppath)
// ext4_find_extent fails to free path
// but zeroout succeeds
ext4_ext_show_leaf(inode, path)
eh = path[depth].p_hdr
// path use-after-free !!!
Similar to ext4_split_extent_at(), we use *ppath directly as an input to
ext4_ext_show_leaf(). Fix a spelling error by the way.
Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only
used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does
not affect functionality.
Solution(s)
References
- CVE-2024-49889
- https://attackerkb.com/topics/CVE-2024-49889
- UBUNTU-USN-7166-1
- UBUNTU-USN-7166-2
- UBUNTU-USN-7166-3
- UBUNTU-USN-7166-4
- UBUNTU-USN-7186-1
- UBUNTU-USN-7186-2
- UBUNTU-USN-7194-1
- UBUNTU-USN-7276-1
- UBUNTU-USN-7277-1
- UBUNTU-USN-7301-1
- UBUNTU-USN-7303-1
- UBUNTU-USN-7303-2
- UBUNTU-USN-7303-3
- UBUNTU-USN-7304-1
- UBUNTU-USN-7310-1
- UBUNTU-USN-7311-1
- UBUNTU-USN-7384-1
- UBUNTU-USN-7384-2
- UBUNTU-USN-7385-1
- UBUNTU-USN-7386-1
- UBUNTU-USN-7403-1
- UBUNTU-USN-7468-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.