CVE-2024-49883 (GCVE-0-2024-49883)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-08-05 11:40
VLAI
Title
ext4: aovid use-after-free in ext4_ext_insert_extent()
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 10809df84a4d868db61af621bae3658494165279 , < e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1 (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < 975ca06f3fd154c5f7742083e7b2574c57d1c0c3 (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < 5e811066c5ab709b070659197dccfb80ab650ddd (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < 9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < 51db04892a993cace63415be99848970a0f15ef2 (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < 8162ee5d94b8c0351be0a9321be134872a7654a1 (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < beb7b66fb489041c50c6473100b383f7a51648fc (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b (git)
Affected: 10809df84a4d868db61af621bae3658494165279 , < a164f3a432aae62ca23d03e6d926b122ee5b860d (git)
Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 4.19.323 , ≤ 4.19.* (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:45:23.101470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:50.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:49.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "975ca06f3fd154c5f7742083e7b2574c57d1c0c3",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "5e811066c5ab709b070659197dccfb80ab650ddd",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "51db04892a993cace63415be99848970a0f15ef2",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "8162ee5d94b8c0351be0a9321be134872a7654a1",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "beb7b66fb489041c50c6473100b383f7a51648fc",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            },
            {
              "lessThan": "a164f3a432aae62ca23d03e6d926b122ee5b860d",
              "status": "affected",
              "version": "10809df84a4d868db61af621bae3658494165279",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: aovid use-after-free in ext4_ext_insert_extent()\n\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\nreallocated in ext4_ext_create_new_leaf(), we\u0027ll use the stale path and\ncause UAF. Below is a sample trace with dummy values:\n\next4_ext_insert_extent\n  path = *ppath = 2000\n  ext4_ext_create_new_leaf(ppath)\n    ext4_find_extent(ppath)\n      path = *ppath = 2000\n      if (depth \u003e path[0].p_maxdepth)\n            kfree(path = 2000);\n            *ppath = path = NULL;\n      path = kcalloc() = 3000\n      *ppath = 3000;\n      return path;\n  /* here path is still 2000, UAF! */\n  eh = path[depth].p_hdr\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\nCall Trace:\n \u003cTASK\u003e\n ext4_ext_insert_extent+0x26d4/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n[...]\n\nAllocated by task 179:\n ext4_find_extent+0x81c/0x1f70\n ext4_ext_map_blocks+0x146/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n\nFreed by task 179:\n kfree+0xcb/0x240\n ext4_find_extent+0x7c0/0x1f70\n ext4_ext_insert_extent+0xa26/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n==================================================================\n\nSo use *ppath to update the path to avoid the above problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local filesystem operations \u2014 write(2)/writeback via ext4_do_writepages \u2192 ext4_map_blocks \u2192 ext4_ext_map_blocks, direct I/O, and fallocate(2) \u2014 on a mounted ext4 volume. ext4 is a local filesystem subsystem with no network protocol handler in the path.\nAC:L - This is a deterministic stale-pointer logic bug, not a race: the attacker fully controls file fragmentation and therefore the extent-tree depth that forces ext4_ext_create_new_leaf() \u2192 ext4_ext_grow_indepth() \u2192 the reallocating ext4_find_extent(). The attacker also picks the depth so the freed kcalloc(depth+2, 48) object and the replacement land in different kmalloc size classes, leaving the freed object reclaimable by their own spraying thread.\nPR:L - There is no capable() or CAP_* check anywhere in fs/ext4/extents.c; any unprivileged local user with write access to an ext4 filesystem (/tmp, /home, Android /data, or any user-writable mount) reaches ext4_ext_insert_extent() with plain write() and fallocate() calls. No user-namespace trick or elevated privilege is needed.\nUI:N - The attacker triggers the entire sequence with their own syscalls on their own files on an already-mounted filesystem. No victim action such as mounting a crafted image or opening a supplied file is required.\nS:U - The use-after-free is confined to the kernel\u0027s own slab memory and the ext4 extent path array, so all impact stays within the kernel security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed path array is a general-cache kmalloc object the attacker can reclaim and populate via heap spraying, giving control over path[depth].p_hdr, p_ext and p_bh, which are dereferenced as kernel pointers for extent-header and buffer_head reads. Per use-after-free scoring guidance this reclaim-and-read primitive is treated as arbitrary kernel memory disclosure.\nI:H - Unlike a read-only UAF, the post-free code writes through the stale pointers: memmove(nearex+1, nearex, len * sizeof(struct ext4_extent)) with attacker-influenced source, destination and length, le16_add_cpu(\u0026eh-\u003eeh_entries, 1), a 12-byte extent store of attacker-chosen logical/physical block values, and ext4_ext_get_access()/ext4_ext_dirty() on a stale buffer_head fed into jbd2. That is a controlled kernel write primitive suitable for privilege escalation.\nA:H - Dereferencing the freed path array in the writeback path yields a garbage extent header and buffer_head, producing the KASAN slab-use-after-free oops shown in the commit message, or a panic from the subsequent memmove and journal operations. Any use-after-free reliably crashes the kernel even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:21.427Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1"
        },
        {
          "url": "https://git.kernel.org/stable/c/975ca06f3fd154c5f7742083e7b2574c57d1c0c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e811066c5ab709b070659197dccfb80ab650ddd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a"
        },
        {
          "url": "https://git.kernel.org/stable/c/51db04892a993cace63415be99848970a0f15ef2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8162ee5d94b8c0351be0a9321be134872a7654a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/beb7b66fb489041c50c6473100b383f7a51648fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a164f3a432aae62ca23d03e6d926b122ee5b860d"
        }
      ],
      "title": "ext4: aovid use-after-free in ext4_ext_insert_extent()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49883",
    "datePublished": "2024-10-21T18:01:20.827Z",
    "dateReserved": "2024-10-21T12:17:06.021Z",
    "dateUpdated": "2026-08-05T11:40:21.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49883",
      "date": "2026-08-05",
      "epss": "0.00278",
      "percentile": "0.19967"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.18\", \"versionEndExcluding\": \"5.10.227\", \"matchCriteriaId\": \"5C882E98-F19D-47B6-A807-73BB9ABA763C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"4D51C05D-455B-4D8D-89E7-A58E140B864C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: aovid use-after-free in ext4_ext_insert_extent()\\n\\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\\nreallocated in ext4_ext_create_new_leaf(), we\u0027ll use the stale path and\\ncause UAF. Below is a sample trace with dummy values:\\n\\next4_ext_insert_extent\\n  path = *ppath = 2000\\n  ext4_ext_create_new_leaf(ppath)\\n    ext4_find_extent(ppath)\\n      path = *ppath = 2000\\n      if (depth \u003e path[0].p_maxdepth)\\n            kfree(path = 2000);\\n            *ppath = path = NULL;\\n      path = kcalloc() = 3000\\n      *ppath = 3000;\\n      return path;\\n  /* here path is still 2000, UAF! */\\n  eh = path[depth].p_hdr\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\\nCall Trace:\\n \u003cTASK\u003e\\n ext4_ext_insert_extent+0x26d4/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n[...]\\n\\nAllocated by task 179:\\n ext4_find_extent+0x81c/0x1f70\\n ext4_ext_map_blocks+0x146/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n\\nFreed by task 179:\\n kfree+0xcb/0x240\\n ext4_find_extent+0x7c0/0x1f70\\n ext4_ext_insert_extent+0xa26/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n==================================================================\\n\\nSo use *ppath to update the path to avoid the above problem.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: evitar use-after-free en ext4_ext_insert_extent() Como mencion\\u00f3 Ojaswin en Link, en ext4_ext_insert_extent(), si la ruta se reasigna en ext4_ext_create_new_leaf(), usaremos la ruta obsoleta y causaremos UAF. A continuaci\\u00f3n, se muestra un seguimiento de muestra con valores ficticios: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth \u0026gt; path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* aqu\\u00ed la ruta sigue siendo 2000, UAF! */ eh = path[depth].p_hdr ===================================================================== ERROR: KASAN: slab-use-after-free en ext4_ext_insert_extent+0x26d4/0x3330 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff8881027bf7d0 por la tarea kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 No contaminado 6.11.0-rc2-dirty #866 Seguimiento de llamadas:  ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Asignado por la tarea 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Liberado por la tarea 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...]==================================================================  As\\u00ed que use *ppath para actualizar el path para evitar el problema de arriba\"}]",
      "id": "CVE-2024-49883",
      "lastModified": "2024-11-08T16:15:30.293",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T18:15:11.060",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/51db04892a993cace63415be99848970a0f15ef2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5e811066c5ab709b070659197dccfb80ab650ddd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8162ee5d94b8c0351be0a9321be134872a7654a1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/975ca06f3fd154c5f7742083e7b2574c57d1c0c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a164f3a432aae62ca23d03e6d926b122ee5b860d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/beb7b66fb489041c50c6473100b383f7a51648fc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:55:27.000Z",
      "cve": "CVE-2024-49883",
      "id": "msrc_CVE-2024-49883",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ext4: aovid use-after-free in ext4_ext_insert_extent()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49883.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49883\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:11.060\",\"lastModified\":\"2026-08-04T11:20:55.747\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: aovid use-after-free in ext4_ext_insert_extent()\\n\\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\\nreallocated in ext4_ext_create_new_leaf(), we\u0027ll use the stale path and\\ncause UAF. Below is a sample trace with dummy values:\\n\\next4_ext_insert_extent\\n  path = *ppath = 2000\\n  ext4_ext_create_new_leaf(ppath)\\n    ext4_find_extent(ppath)\\n      path = *ppath = 2000\\n      if (depth \u003e path[0].p_maxdepth)\\n            kfree(path = 2000);\\n            *ppath = path = NULL;\\n      path = kcalloc() = 3000\\n      *ppath = 3000;\\n      return path;\\n  /* here path is still 2000, UAF! */\\n  eh = path[depth].p_hdr\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\\nCall Trace:\\n \u003cTASK\u003e\\n ext4_ext_insert_extent+0x26d4/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n[...]\\n\\nAllocated by task 179:\\n ext4_find_extent+0x81c/0x1f70\\n ext4_ext_map_blocks+0x146/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n\\nFreed by task 179:\\n kfree+0xcb/0x240\\n ext4_find_extent+0x7c0/0x1f70\\n ext4_ext_insert_extent+0xa26/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n==================================================================\\n\\nSo use *ppath to update the path to avoid the above problem.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: evitar use-after-free en ext4_ext_insert_extent() Como mencion\u00f3 Ojaswin en Link, en ext4_ext_insert_extent(), si la ruta se reasigna en ext4_ext_create_new_leaf(), usaremos la ruta obsoleta y causaremos UAF. A continuaci\u00f3n, se muestra un seguimiento de muestra con valores ficticios: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth \u0026gt; path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* aqu\u00ed la ruta sigue siendo 2000, UAF! */ eh = path[depth].p_hdr ===================================================================== ERROR: KASAN: slab-use-after-free en ext4_ext_insert_extent+0x26d4/0x3330 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8881027bf7d0 por la tarea kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 No contaminado 6.11.0-rc2-dirty #866 Seguimiento de llamadas:  ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Asignado por la tarea 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Liberado por la tarea 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...]==================================================================  As\u00ed que use *ppath para actualizar el path para evitar el problema de arriba\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/extents.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"975ca06f3fd154c5f7742083e7b2574c57d1c0c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"5e811066c5ab709b070659197dccfb80ab650ddd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"51db04892a993cace63415be99848970a0f15ef2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"8162ee5d94b8c0351be0a9321be134872a7654a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"beb7b66fb489041c50c6473100b383f7a51648fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10809df84a4d868db61af621bae3658494165279\",\"lessThan\":\"a164f3a432aae62ca23d03e6d926b122ee5b860d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/extents.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:45:23.101470Z\",\"id\":\"CVE-2024-49883\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"4CF15846-AEEF-4FBF-BED3-18AFD682270F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"795A3EE6-0CAB-4409-A903-151C94ACECC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/51db04892a993cace63415be99848970a0f15ef2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e811066c5ab709b070659197dccfb80ab650ddd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8162ee5d94b8c0351be0a9321be134872a7654a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/975ca06f3fd154c5f7742083e7b2574c57d1c0c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a164f3a432aae62ca23d03e6d926b122ee5b860d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/beb7b66fb489041c50c6473100b383f7a51648fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:53:24+00:00",
      "cve": "CVE-2024-49883",
      "id": "CVE-2024-49883",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: aovid use-after-free in ext4_ext_insert_extent()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49883.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:32:54Z",
      "cve": "CVE-2024-49883",
      "id": "CVE-2024-49883",
      "initial_release_date": "2024-10-25T03:07:25Z",
      "product_status:known_affected": "573",
      "product_status:known_not_affected": "51",
      "product_status:recommended": "725",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49883",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49883.json",
      "version": "71"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:49.557Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49883\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:45:23.101470Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:45:26.221Z\"}}], \"cna\": {\"title\": \"ext4: aovid use-after-free in ext4_ext_insert_extent()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"975ca06f3fd154c5f7742083e7b2574c57d1c0c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"5e811066c5ab709b070659197dccfb80ab650ddd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"51db04892a993cace63415be99848970a0f15ef2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"8162ee5d94b8c0351be0a9321be134872a7654a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"beb7b66fb489041c50c6473100b383f7a51648fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10809df84a4d868db61af621bae3658494165279\", \"lessThan\": \"a164f3a432aae62ca23d03e6d926b122ee5b860d\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/extents.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/extents.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1\"}, {\"url\": \"https://git.kernel.org/stable/c/975ca06f3fd154c5f7742083e7b2574c57d1c0c3\"}, {\"url\": \"https://git.kernel.org/stable/c/5e811066c5ab709b070659197dccfb80ab650ddd\"}, {\"url\": \"https://git.kernel.org/stable/c/9df59009dfc6d9fc1bd9ddf6c5ab6e56d6ed887a\"}, {\"url\": \"https://git.kernel.org/stable/c/51db04892a993cace63415be99848970a0f15ef2\"}, {\"url\": \"https://git.kernel.org/stable/c/8162ee5d94b8c0351be0a9321be134872a7654a1\"}, {\"url\": \"https://git.kernel.org/stable/c/beb7b66fb489041c50c6473100b383f7a51648fc\"}, {\"url\": \"https://git.kernel.org/stable/c/bfed082ce4b1ce6349b05c09a0fa4f3da35ecb1b\"}, {\"url\": \"https://git.kernel.org/stable/c/a164f3a432aae62ca23d03e6d926b122ee5b860d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: aovid use-after-free in ext4_ext_insert_extent()\\n\\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\\nreallocated in ext4_ext_create_new_leaf(), we\u0027ll use the stale path and\\ncause UAF. Below is a sample trace with dummy values:\\n\\next4_ext_insert_extent\\n  path = *ppath = 2000\\n  ext4_ext_create_new_leaf(ppath)\\n    ext4_find_extent(ppath)\\n      path = *ppath = 2000\\n      if (depth \u003e path[0].p_maxdepth)\\n            kfree(path = 2000);\\n            *ppath = path = NULL;\\n      path = kcalloc() = 3000\\n      *ppath = 3000;\\n      return path;\\n  /* here path is still 2000, UAF! */\\n  eh = path[depth].p_hdr\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\\nCall Trace:\\n \u003cTASK\u003e\\n ext4_ext_insert_extent+0x26d4/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n[...]\\n\\nAllocated by task 179:\\n ext4_find_extent+0x81c/0x1f70\\n ext4_ext_map_blocks+0x146/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n\\nFreed by task 179:\\n kfree+0xcb/0x240\\n ext4_find_extent+0x7c0/0x1f70\\n ext4_ext_insert_extent+0xa26/0x3330\\n ext4_ext_map_blocks+0xe22/0x2d40\\n ext4_map_blocks+0x71e/0x1700\\n ext4_do_writepages+0x1290/0x2800\\n ext4_writepages+0x26d/0x4e0\\n do_writepages+0x175/0x700\\n[...]\\n==================================================================\\n\\nSo use *ppath to update the path to avoid the above problem.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:40:24.275Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49883\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:22:49.557Z\", \"dateReserved\": \"2024-10-21T12:17:06.021Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:20.827Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.