In the Linux kernel, the following vulnerability has been resolved:
ext4: drop ppath from ext4extreplayupdateex() to avoid double-free
When calling ext4forcesplitextentat() in ext4extreplayupdateex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process:
ext4extreplayupdateex ppath = path ext4forcesplitextentat(&ppath) ext4splitextentat ext4extinsertextent ext4extcreatenewleaf ext4extgrowindepth ext4findextent if (depth > path[0].pmaxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!!
So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4findextent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4findextent() instead of using strange error codes.
[
{
"signature_type": "Line",
"id": "CVE-2024-49983-05d7ac56",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6367d3f04c69e2b8770b8137bd800e0784b0abbc",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-28293c04",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63adc9016917e6970fb0104ee5fd6770f02b2d80",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-3917ce4a",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a34bed978364114390162c27e50fca50791c568d",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-43848201",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a34bed978364114390162c27e50fca50791c568d",
"signature_version": "v1",
"digest": {
"function_hash": "94457211364804562990447561179004529820",
"length": 1501.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-4b717a81",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c26d9e53e5fbacda0732a577e97c5a5b7882aaf",
"signature_version": "v1",
"digest": {
"function_hash": "94457211364804562990447561179004529820",
"length": 1501.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-4c54d3ec",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6367d3f04c69e2b8770b8137bd800e0784b0abbc",
"signature_version": "v1",
"digest": {
"function_hash": "300077788810400475670472171962563536857",
"length": 1482.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-567f367e",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c26d9e53e5fbacda0732a577e97c5a5b7882aaf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-631b918e",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-69663fd4",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95",
"signature_version": "v1",
"digest": {
"function_hash": "300077788810400475670472171962563536857",
"length": 1482.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-80f85e59",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff710662e8d86a63a39b334e9ca0cb10e5c14b0",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-969101fa",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ff710662e8d86a63a39b334e9ca0cb10e5c14b0",
"signature_version": "v1",
"digest": {
"function_hash": "300077788810400475670472171962563536857",
"length": 1482.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-e2140d20",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63adc9016917e6970fb0104ee5fd6770f02b2d80",
"signature_version": "v1",
"digest": {
"function_hash": "300077788810400475670472171962563536857",
"length": 1482.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-49983-e88cfdc4",
"target": {
"file": "fs/ext4/extents.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b558006d98b7b0b730027be0ee98973dd10ee0d",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90046064991480057412247917619390175284",
"339122269955003579161226649298609955778",
"157750984999767964799470355787243135249",
"249586333731235022866625610542986786983",
"82006645875954867611652165810468378341",
"50368891852439521558399422455145239553",
"191876751795255131054624370052671537792",
"43342242086599357086362469072398308978",
"62104003580635796029223340108456753081",
"64876523203008430069792699817324694156",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"53199844055056143605392676566758790271",
"20476886351331472571265546753153732558",
"292588488750921834977975064551784391785",
"53820113859132372180617729101407728348",
"69751353049038458566617567629961306437",
"193413212321225018358781795836224185230",
"166545868661818336012275166344086434303",
"318368813202440102910511869180174302304",
"48374927184678393297194108084055641834",
"325551121265835859792963732436463100462",
"245369930184110692864343584003824911068",
"62145958339712385663008253545601436062",
"112382086042918565064090625919963693514",
"29721337331412194991191185222616677897",
"57610949107318031254566353311750611293",
"16701785774950299921135370359818782003",
"135586019731976260193923280814903367047",
"85019107676710077703422032468260436504"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-49983-eab32a63",
"target": {
"file": "fs/ext4/extents.c",
"function": "ext4_ext_replay_update_ex"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b558006d98b7b0b730027be0ee98973dd10ee0d",
"signature_version": "v1",
"digest": {
"function_hash": "300077788810400475670472171962563536857",
"length": 1482.0
},
"deprecated": false
}
]