REDHAT-BUG-2420347: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix use-after-free in ext4orphancleanup
I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in listaddvalid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710
CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370 Call Trace: <TASK> dumpstacklvl+0x73/0x9f printreport+0x25d/0x759 kasanreport+0xc0/0x120 asanload8+0x99/0x140 listaddvalid+0x28/0x1a0 ext4orphancleanup+0x564/0x9d0 [ext4] ext4fillsuper+0x48e2/0x5300 [ext4] ext4fillsuper+0x19f/0x3a0 [ext4] gettreebdev+0x27b/0x450 ext4gettree+0x19/0x30 [ext4] vfsgettree+0x49/0x150 pathmount+0xaae/0x1350 domount+0xe2/0x110 x64sysmount+0xf0/0x190 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x63/0xcd </TASK> [...] ==================================================================
Above issue may happen as follows: ------------------------------------- ext4fillsuper ext4orphancleanup --- loop1: assume lastorphan is 12 --- listadd(&EXT4I(inode)->iorphan, &EXT4SB(sb)->sorphan) ext4truncate --> return 0 ext4inodeattachjinode --> return -ENOMEM iput(inode) --> free inode<12> --- loop2: lastorphan is still 12 --- listadd(&EXT4I(inode)->iorphan, &EXT4SB(sb)->sorphan); // use inode<12> and trigger UAF
To solve this issue, we need to propagate the return value of ext4inodeattachjinode() appropriately.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
The reported use-after-free occurs during ext4 orphan cleanup while mounting an ext4 filesystem, in the ext4_orphan_cleanup path.
What evidence may indicate exposure or attempted reproduction?
A KASAN-enabled kernel may report a use-after-free in __list_add_valid, with a stack trace including ext4_orphan_cleanup, __ext4_fill_super, ext4_fill_super, and mount-related functions such as path_mount and do_mount.
Are fixes available from Red Hat?
The provided references include Red Hat advisories RHSA-2026:2264 and RHSA-2026:2378. Consult the applicable advisory for the affected product stream and update information.