CVE-2024-49882

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_d...

Affected product and versions

Product

Linux Linux, debian linux, linux kernel

Affected versions

>= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < d4574bda63906bf69660e001470bfe1a0ac524ae, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < f9fd47c9d9548f9e47fa60098eab99dde175401d, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < 32bbb59e3f18facd7201bef110010bf35819b8c3, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < 78bbc3d15b6f443acb26e94418c445bac940d414, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < 68a69cf60660c73990c1875f94a5551600b04775, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < 7633407ca4ab8be2916ab214eb44ccebc6a50e1a, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < 230ee0535d01478bad9a3037292043f39b9be10b, >= ecb94f5fdf4b72547fca022421a9dca1672bddd4 < dcaa6c31134c0f515600111c38ed7750003e1b9c, >= 3.7, 11.0, >= 3.7 < 4.19.323, >= 4.20 < 5.4.285, >= 5.5 < 5.10.227, >= 5.11 < 5.15.168, >= 5.16 < 6.1.113, >= 6.2 < 6.6.55, >= 6.7 < 6.10.14, >= 6.11 < 6.11.3

Fixed versions

4.19.323, 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415