In the Linux kernel, the following vulnerability has been resolved:
ext4: fix timer use-after-free on failed mount
Syzbot has found an ODEBUG bug in ext4fillsuper
The deltimersync function cancels the serrreport timer, which reminds about filesystem errors daily. We should guarantee the timer is no longer active before kfree(sbi).
When filesystem mounting fails, the flow goes to failedmount3, where an error occurs when ext4stopmmpd is called, causing a read I/O failure. This triggers the ext4handleerror function that ultimately re-arms the timer, leaving the serr_report timer active before kfree(sbi) is called.
Fix the issue by canceling the serrreport timer after calling ext4stopmmpd.
[
{
"id": "CVE-2024-49960-1ace2794",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "ext4_fill_super"
},
"digest": {
"function_hash": "329820521871027668444688056811897874098",
"length": 31277.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aac0c17a8cdf4a3236991c1e60435c6a984076c"
},
{
"id": "CVE-2024-49960-1b1035fe",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "ext4_fill_super"
},
"digest": {
"function_hash": "37117991773158149592763269005558782555",
"length": 31746.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22e9b83f0f33bc5a7a3181769d1dccbf021f5b04"
},
{
"id": "CVE-2024-49960-297dd589",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
},
"digest": {
"function_hash": "92039222303056225547629578493142677964",
"length": 14666.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf3196e5e2f36cd80dab91ffae402e13935724bc"
},
{
"id": "CVE-2024-49960-3291040d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"283207432115060025667923247505516099500",
"172433755566317131195038564555581465542",
"257276649337637857143632188917253012546",
"214672666156564957763892053522810476827",
"78870891729227241014745330966474396021"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ce160c5bdb67081a62293028dc85758a8efb22a"
},
{
"id": "CVE-2024-49960-33711870",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
},
"digest": {
"function_hash": "141892849686058904714015353339865758218",
"length": 10479.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa78fb51d396f4f2f80f8e96a3b1516f394258be"
},
{
"id": "CVE-2024-49960-3f61142f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"283207432115060025667923247505516099500",
"172433755566317131195038564555581465542",
"257276649337637857143632188917253012546",
"214672666156564957763892053522810476827",
"78870891729227241014745330966474396021"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b85569585d0154d4db1e4f9e3e6a4731d407feb0"
},
{
"id": "CVE-2024-49960-4b62dc62",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
},
"digest": {
"function_hash": "92040925712339398597479704685412436813",
"length": 10541.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ce160c5bdb67081a62293028dc85758a8efb22a"
},
{
"id": "CVE-2024-49960-5a5756de",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"228922197928238408063209526359064045166",
"231500799706349219378290649865764810453",
"203921256252466518611521508105676848326",
"261567802248138488675311314471459968694",
"48936492136325136488455686394790753153"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aac0c17a8cdf4a3236991c1e60435c6a984076c"
},
{
"id": "CVE-2024-49960-5c22c558",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"134984671993910969571968512894962090116",
"37802969222178293338997364546661533033",
"205864244913728848561988360619131375436",
"214672666156564957763892053522810476827",
"78870891729227241014745330966474396021"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf3196e5e2f36cd80dab91ffae402e13935724bc"
},
{
"id": "CVE-2024-49960-6db5d6f4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
},
"digest": {
"function_hash": "56798763054920462711848281612289593963",
"length": 10516.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b85569585d0154d4db1e4f9e3e6a4731d407feb0"
},
{
"id": "CVE-2024-49960-948e6482",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"283207432115060025667923247505516099500",
"172433755566317131195038564555581465542",
"257276649337637857143632188917253012546",
"214672666156564957763892053522810476827",
"78870891729227241014745330966474396021"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9203817ba46ebba7c865c8de2aba399537b6e891"
},
{
"id": "CVE-2024-49960-95ffb2ab",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"283207432115060025667923247505516099500",
"172433755566317131195038564555581465542",
"257276649337637857143632188917253012546",
"214672666156564957763892053522810476827",
"78870891729227241014745330966474396021"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa78fb51d396f4f2f80f8e96a3b1516f394258be"
},
{
"id": "CVE-2024-49960-9d1aeea0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/ext4/super.c",
"function": "__ext4_fill_super"
},
"digest": {
"function_hash": "257720978872676830459040284157450265745",
"length": 10440.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9203817ba46ebba7c865c8de2aba399537b6e891"
},
{
"id": "CVE-2024-49960-d3f15543",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/ext4/super.c"
},
"digest": {
"line_hashes": [
"134984671993910969571968512894962090116",
"37802969222178293338997364546661533033",
"98647317512029060679807969347444779987",
"261567802248138488675311314471459968694",
"48936492136325136488455686394790753153"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22e9b83f0f33bc5a7a3181769d1dccbf021f5b04"
}
]