CVE-2024-49903: jfs: Fix uaf in dbFreeBits
In the Linux kernel, the following vulnerability has been resolved:
jfs: Fix uaf in dbFreeBits
[syzbot reported] ================================================================== BUG: KASAN: slab-use-after-free in mutexlockcommon kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in mutexlock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216
CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:93 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:119 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0x169/0x550 mm/kasan/report.c:488 kasanreport+0x143/0x180 mm/kasan/report.c:601 mutexlockcommon kernel/locking/mutex.c:587 [inline] mutexlock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfsdmap.c:2390 dbFreeDmap fs/jfs/jfsdmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfsdmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfsdmap.c:1650 jfsioctrim+0x433/0x670 fs/jfs/jfsdiscard.c:100 jfsioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl+0xfc/0x170 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83
Freed by task 5218: kasansavestack mm/kasan/common.c:47 [inline] kasansavetrack+0x3f/0x80 mm/kasan/common.c:68 kasansavefreeinfo+0x40/0x50 mm/kasan/generic.c:579 poisonslabobject+0xe0/0x150 mm/kasan/common.c:240 kasanslabfree+0x37/0x60 mm/kasan/common.c:256 kasanslabfree include/linux/kasan.h:184 [inline] slabfreehook mm/slub.c:2252 [inline] slabfree mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfsdmap.c:278 jfsmountrw+0x4ac/0x6a0 fs/jfs/jfsmount.c:247 jfsremount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfiguresuper+0x445/0x880 fs/super.c:1083 vfscmdreconfigure fs/fsopen.c:263 [inline] vfsfsconfiglocked fs/fsopen.c:292 [inline] dosysfsconfig fs/fsopen.c:473 [inline] sesysfsconfig+0xb6e/0xf80 fs/fsopen.c:345 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
[Analysis] There are two paths (dbUnmount and jfsioctrim) that generate race condition when accessing bmap, which leads to the occurrence of uaf.
Use the lock sumount to synchronize them, in order to avoid uaf caused by race condition.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49903?
CVE-2024-49903 is classified as a high severity vulnerability due to its impact on kernel memory management.
How do I fix CVE-2024-49903?
To resolve CVE-2024-49903, upgrade to the latest Linux kernel version that includes the patch for the use-after-free vulnerability.
What systems are affected by CVE-2024-49903?
CVE-2024-49903 affects multiple versions of the Linux kernel, specifically versions prior to 5.10.227 and various ranges between 5.11 and 6.11.
What type of vulnerability is CVE-2024-49903?
CVE-2024-49903 is classified as a use-after-free vulnerability that could lead to kernel memory corruption and instability.
Who is responsible for disclosing CVE-2024-49903?
CVE-2024-49903 was reported by syzbot, a tool for identifying vulnerabilities in the Linux kernel.