In the Linux kernel, the following vulnerability has been resolved:
ext4: drop ppath from ext4extreplayupdateex() to avoid double-free
When calling ext4forcesplitextentat() in ext4extreplayupdateex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process:
ext4extreplayupdateex ppath = path ext4forcesplitextentat(&ppath) ext4splitextentat ext4extinsertextent ext4extcreatenewleaf ext4extgrowindepth ext4findextent if (depth > path[0].pmaxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!!
So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4findextent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4findextent() instead of using strange error codes.
[
    {
        "id": "CVE-2024-49983-05d7ac56",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6367d3f04c69e2b8770b8137bd800e0784b0abbc"
    },
    {
        "id": "CVE-2024-49983-28293c04",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63adc9016917e6970fb0104ee5fd6770f02b2d80"
    },
    {
        "id": "CVE-2024-49983-3917ce4a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a34bed978364114390162c27e50fca50791c568d"
    },
    {
        "id": "CVE-2024-49983-43848201",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "94457211364804562990447561179004529820",
            "length": 1501.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a34bed978364114390162c27e50fca50791c568d"
    },
    {
        "id": "CVE-2024-49983-4b717a81",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "94457211364804562990447561179004529820",
            "length": 1501.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
    },
    {
        "id": "CVE-2024-49983-4c54d3ec",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "300077788810400475670472171962563536857",
            "length": 1482.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6367d3f04c69e2b8770b8137bd800e0784b0abbc"
    },
    {
        "id": "CVE-2024-49983-567f367e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
    },
    {
        "id": "CVE-2024-49983-631b918e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
    },
    {
        "id": "CVE-2024-49983-69663fd4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "300077788810400475670472171962563536857",
            "length": 1482.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
    },
    {
        "id": "CVE-2024-49983-80f85e59",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
    },
    {
        "id": "CVE-2024-49983-969101fa",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "300077788810400475670472171962563536857",
            "length": 1482.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
    },
    {
        "id": "CVE-2024-49983-e2140d20",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "300077788810400475670472171962563536857",
            "length": 1482.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63adc9016917e6970fb0104ee5fd6770f02b2d80"
    },
    {
        "id": "CVE-2024-49983-e88cfdc4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/ext4/extents.c"
        },
        "digest": {
            "line_hashes": [
                "90046064991480057412247917619390175284",
                "339122269955003579161226649298609955778",
                "157750984999767964799470355787243135249",
                "249586333731235022866625610542986786983",
                "82006645875954867611652165810468378341",
                "50368891852439521558399422455145239553",
                "191876751795255131054624370052671537792",
                "43342242086599357086362469072398308978",
                "62104003580635796029223340108456753081",
                "64876523203008430069792699817324694156",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "53199844055056143605392676566758790271",
                "20476886351331472571265546753153732558",
                "292588488750921834977975064551784391785",
                "53820113859132372180617729101407728348",
                "69751353049038458566617567629961306437",
                "193413212321225018358781795836224185230",
                "166545868661818336012275166344086434303",
                "318368813202440102910511869180174302304",
                "48374927184678393297194108084055641834",
                "325551121265835859792963732436463100462",
                "245369930184110692864343584003824911068",
                "62145958339712385663008253545601436062",
                "112382086042918565064090625919963693514",
                "29721337331412194991191185222616677897",
                "57610949107318031254566353311750611293",
                "16701785774950299921135370359818782003",
                "135586019731976260193923280814903367047",
                "85019107676710077703422032468260436504"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b558006d98b7b0b730027be0ee98973dd10ee0d"
    },
    {
        "id": "CVE-2024-49983-eab32a63",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/ext4/extents.c",
            "function": "ext4_ext_replay_update_ex"
        },
        "digest": {
            "function_hash": "300077788810400475670472171962563536857",
            "length": 1482.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b558006d98b7b0b730027be0ee98973dd10ee0d"
    }
]