CVE-2024-57892: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix slab-use-after-free due to dangling pointer dqipriv
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quotagetnextquota. Specifically, sbdqinfo(sb, type)->dqipriv is the dangling pointer.
During the remounting process, the pointer dqipriv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOTSUSPENDED flag instead of setting the DQUOTUSAGEENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2getnextid is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqipriv to null when it is freed after remounting with read-only and put a check for DQUOTSUSPENDED in ocfs2getnextid.
[akpm@linux-foundation.org: coding-style cleanups]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57892?
CVE-2024-57892 has a high severity due to potential exploitation leading to memory corruption.
How do I fix CVE-2024-57892?
To mitigate CVE-2024-57892, update the Linux kernel to a version that includes the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2024-57892?
CVE-2024-57892 affects Linux kernel versions from 4.6 up to 6.1.125 and between 6.2 and 6.6.70.
What component is impacted by CVE-2024-57892?
CVE-2024-57892 impacts the ocfs2 filesystem within the Linux kernel.
Is CVE-2024-57892 exploitable remotely?
CVE-2024-57892 may be exploitable locally when specific user operations are performed on the ocfs2 filesystem.