CVE-2024-49882: ext4: fix double brelse() the buffer of the extents path
ext4: fix double brelse() the buffer of the extents path
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Apply the ext4 fix: in ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released to prevent double brelse() (buffer freed twice).
Linux kernel ext4 In ext4_ext_try_to_merge_up(), clear path[1].p_bh after release = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49882?
CVE-2024-49882 has a moderate severity rating due to the potential for double buffer release in the ext4 file system.
How do I fix CVE-2024-49882?
To fix CVE-2024-49882, update to the latest patched versions of the Linux kernel or any specific secure versions provided by your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2024-49882?
CVE-2024-49882 affects various Linux kernel versions from 3.7 up to 6.11.3, with multiple specific sub-versions in between.
What is the cause of CVE-2024-49882?
CVE-2024-49882 is caused by a failure to set the path buffer to NULL after releasing it, leading to potential double release issues.
Is there a public reference for CVE-2024-49882?
Yes, there are public references available for CVE-2024-49882 on the kernel.org stable repositories.