CVE-2024-49889

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we us...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= dfe5080939ea4686b3414b5d970a9b26733c57a4 < b0cb4561fc4284d04e69c8a66c8504928ab2484e, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < 4999fed877bb64e3e7f9ab9996de2ca983c41928, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < 2eba3b0cc5b8de624918d21f32b5b8db59a90b39, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < 34b2096380ba475771971a778a478661a791aa15, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < 8b114f2cc7dd5d36729d040b68432fbd0f0a8868, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < d483c7cc1796bd6a80e7b3a8fd494996260f6b67, >= dfe5080939ea4686b3414b5d970a9b26733c57a4 < 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5, >= 3.18, < V3.2, < 5.10.227, >= 5.11 < 5.15.168, >= 5.16 < 6.1.113, >= 6.2 < 6.6.55, >= 6.7 < 6.10.14, >= 6.11 < 6.11.3

Fixed versions

5.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416