{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49882", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.021Z", "datePublished": "2024-10-21T18:01:20.144Z", "dateUpdated": "2026-08-05T11:40:20.352Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:20.352Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double brelse() the buffer of the extents path\n\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\nreleased, otherwise it may be released twice. An example of what triggers\nthis is as follows:\n\n split2 map split1\n|--------|-------|--------|\n\next4_ext_map_blocks\n ext4_ext_handle_unwritten_extents\n ext4_split_convert_extents\n // path->p_depth == 0\n ext4_split_extent\n // 1. do split1\n ext4_split_extent_at\n |ext4_ext_insert_extent\n | ext4_ext_create_new_leaf\n | ext4_ext_grow_indepth\n | le16_add_cpu(&neh->eh_depth, 1)\n | ext4_find_extent\n | // return -ENOMEM\n |// get error and try zeroout\n |path = ext4_find_extent\n | path->p_depth = 1\n |ext4_ext_try_to_merge\n | ext4_ext_try_to_merge_up\n | path->p_depth = 0\n | brelse(path[1].p_bh) ---> not set to NULL here\n |// zeroout success\n // 2. update path\n ext4_find_extent\n // 3. do split2\n ext4_split_extent_at\n ext4_ext_insert_extent\n ext4_ext_create_new_leaf\n ext4_ext_grow_indepth\n le16_add_cpu(&neh->eh_depth, 1)\n ext4_find_extent\n path[0].p_bh = NULL;\n path->p_depth = 1\n read_extent_tree_block ---> return err\n // path[1].p_bh is still the old value\n ext4_free_ext_path\n ext4_ext_drop_refs\n // path->p_depth == 1\n brelse(path[1].p_bh) ---> brelse a buffer twice\n\nFinally got the following WARRNING when removing the buffer from lru:\n\n============================================\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\nRIP: 0010:__brelse+0x58/0x90\nCall Trace:\n \n __find_get_block+0x6e7/0x810\n bdev_getblk+0x2b/0x480\n __ext4_get_inode_loc+0x48a/0x1240\n ext4_get_inode_loc+0xb2/0x150\n ext4_reserve_inode_write+0xb7/0x230\n __ext4_mark_inode_dirty+0x144/0x6a0\n ext4_ext_insert_extent+0x9c8/0x3230\n ext4_ext_map_blocks+0xf45/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n============================================" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable extent-split path is reached through ordinary local file operations (fallocate + write/writeback, ZERO_RANGE, punch hole) on a mounted ext4 filesystem, requiring local system access rather than any network protocol handler.\nAC:L - The attacker fully drives both stages — creating unwritten extents and splitting them at will — and can force the required allocation/IO failure deterministically via an attacker-controlled backing device (-EIO), a crafted extent block (-EFSCORRUPTED), or self-inflicted GFP_NOFS memory pressure (-ENOMEM), so no condition lies outside the attacker's influence.\nPR:L - Only an unprivileged local account with write access to any file on an ext4 filesystem (/tmp, /home, an Android app sandbox on /data, a container writable layer) is needed; no capability, root, or namespace escalation is involved.\nUI:N - The attacker performs fallocate() and writes entirely on their own files and can force writeback via fsync(); no victim action such as mounting an image or opening a file is required.\nS:U - The corruption is confined to kernel memory and filesystem metadata within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stolen buffer_head reference lets a live bh and its folio be freed while still in use, yielding a slab use-after-free whose recycled object contents (b_data, b_page, b_end_io) can be read back, and it can drop a refcount on an unrelated inode's metadata buffer, exposing arbitrary page-cache contents.\nI:H - The refcount underflow produces a use-after-free on a bh_cachep object containing the b_end_io function pointer and list pointers, giving heap-spray-based write and control-flow-hijack primitives, plus corruption of another inode's on-disk metadata buffer.\nA:H - The bug reproducibly triggers a WARN in __brelse() (fatal with panic_on_warn) and, in the reference-stealing case, a use-after-free that oopses the kernel and corrupts filesystem metadata, causing a full system crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ext4/extents.c" ], "versions": [ { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "d4574bda63906bf69660e001470bfe1a0ac524ae", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "f9fd47c9d9548f9e47fa60098eab99dde175401d", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "32bbb59e3f18facd7201bef110010bf35819b8c3", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "78bbc3d15b6f443acb26e94418c445bac940d414", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "68a69cf60660c73990c1875f94a5551600b04775", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "7633407ca4ab8be2916ab214eb44ccebc6a50e1a", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "230ee0535d01478bad9a3037292043f39b9be10b", "status": "affected", "versionType": "git" }, { "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4", "lessThan": "dcaa6c31134c0f515600111c38ed7750003e1b9c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ext4/extents.c" ], "versions": [ { "version": "3.7", "status": "affected" }, { "version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.19.323" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.4.285" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d4574bda63906bf69660e001470bfe1a0ac524ae" }, { "url": "https://git.kernel.org/stable/c/f9fd47c9d9548f9e47fa60098eab99dde175401d" }, { "url": "https://git.kernel.org/stable/c/b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e" }, { "url": "https://git.kernel.org/stable/c/32bbb59e3f18facd7201bef110010bf35819b8c3" }, { "url": "https://git.kernel.org/stable/c/78bbc3d15b6f443acb26e94418c445bac940d414" }, { "url": "https://git.kernel.org/stable/c/68a69cf60660c73990c1875f94a5551600b04775" }, { "url": "https://git.kernel.org/stable/c/7633407ca4ab8be2916ab214eb44ccebc6a50e1a" }, { "url": "https://git.kernel.org/stable/c/230ee0535d01478bad9a3037292043f39b9be10b" }, { "url": "https://git.kernel.org/stable/c/dcaa6c31134c0f515600111c38ed7750003e1b9c" } ], "title": "ext4: fix double brelse() the buffer of the extents path", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49882", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:45:30.617937Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:48:50.395Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:22:48.090Z" } } ] } }