CVE-2024-50191: ext4: don't set SB_RDONLY after filesystem errors
First published: Fri Nov 08 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: ext4: don't set SB_RDONLY after filesystem errors When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | <5.15.168 | |
| Linux Kernel | >=5.16<6.1.113 | |
| Linux Kernel | >=6.2<6.6.57 | |
| Linux Kernel | >=6.7<6.11.4 | |
| debian/linux | <=5.10.223-1<=5.10.226-1 | 6.1.123-1 6.1.128-1 6.12.12-1 6.12.13-1 |
| debian/linux-6.1 | 6.1.119-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/4061e07f040a091f694f461b86a26cf95ae66439
- https://git.kernel.org/stable/c/58c0648e4c773f5b54f0cb63bc8c7c6bf52719a9
- https://git.kernel.org/stable/c/d3476f3dad4ad68ae5f6b008ea6591d1520da5d8
- https://git.kernel.org/stable/c/ee77c388469116565e009eaa704a60bc78489e09
- https://git.kernel.org/stable/c/fbb177bc1d6487cd3e9b50ae0be2781b7297980d
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50191
- https://nvd.nist.gov/vuln/detail/CVE-2024-50191
- https://launchpad.net/bugs/cve/CVE-2024-50191
- https://security-tracker.debian.org/tracker/CVE-2024-50191
- https://ubuntu.com/security/CVE-2024-50191
- https://git.kernel.org/linus/d3476f3dad4ad68ae5f6b008ea6591d1520da5d8
Frequently Asked Questions
What is the severity of CVE-2024-50191?
CVE-2024-50191 has a severity rating that indicates potential impacts on filesystem modifications when errors occur.
How do I fix CVE-2024-50191?
To fix CVE-2024-50191, update your Linux kernel to version 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2024-50191?
CVE-2024-50191 affects various versions of the Linux kernel up to 5.15.168 and between 5.16 and 6.1.113.
What is the nature of CVE-2024-50191?
CVE-2024-50191 involves improper handling of the SB_RDONLY flag after filesystem errors in the ext4 filesystem.
Is there a recommended remedial action for CVE-2024-50191?
The recommended action for CVE-2024-50191 is to apply patches or upgrade to the secure versions of the Linux kernel.
- agent/title
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/references
- agent/author
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/source
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- package-manager/debian