GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-57892 (GCVE-0-2024-57892)

Vulnerability from cvelistv5 – Published: 2025-01-15 13:05 – Updated: 2026-05-11 20:59
VLAI
Title
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer. During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags. To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. [akpm@linux-foundation.org: coding-style cleanups]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-13 13:55 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < 58f9e20e2a7602e1dd649a1ec4790077c251cb6c (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < 8ff6f635a08c30559ded0c110c7ce03ba7747d11 (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < f44e6d70c100614c211703f065cad448050e4a0e (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < 2d431192486367eee03cc28d0b53b97dafcb8e63 (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < 2e3d203b1adede46bbba049e497765d67865be18 (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < ba950a02d8d23811aa1120affd3adedcfac6153d (git)
Affected: 8f9e8f5fcc059a3cba87ce837c88316797ef3645 , < 5f3fd772d152229d94602bca243fbb658068a597 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.4.290 , ≤ 5.4.* (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.177 , ≤ 5.15.* (semver)
Unaffected: 6.1.125 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57892",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-13T13:55:16.692610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-13T14:04:27.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:55:05.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/quota_global.c",
            "fs/ocfs2/quota_local.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58f9e20e2a7602e1dd649a1ec4790077c251cb6c",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "8ff6f635a08c30559ded0c110c7ce03ba7747d11",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "f44e6d70c100614c211703f065cad448050e4a0e",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "2d431192486367eee03cc28d0b53b97dafcb8e63",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "2e3d203b1adede46bbba049e497765d67865be18",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "ba950a02d8d23811aa1120affd3adedcfac6153d",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            },
            {
              "lessThan": "5f3fd772d152229d94602bca243fbb658068a597",
              "status": "affected",
              "version": "8f9e8f5fcc059a3cba87ce837c88316797ef3645",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/quota_global.c",
            "fs/ocfs2/quota_local.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.290",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u003edqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:59:55.049Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58f9e20e2a7602e1dd649a1ec4790077c251cb6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ff6f635a08c30559ded0c110c7ce03ba7747d11"
        },
        {
          "url": "https://git.kernel.org/stable/c/f44e6d70c100614c211703f065cad448050e4a0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d431192486367eee03cc28d0b53b97dafcb8e63"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e3d203b1adede46bbba049e497765d67865be18"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba950a02d8d23811aa1120affd3adedcfac6153d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f3fd772d152229d94602bca243fbb658068a597"
        }
      ],
      "title": "ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57892",
    "datePublished": "2025-01-15T13:05:44.635Z",
    "dateReserved": "2025-01-11T14:45:42.028Z",
    "dateUpdated": "2026-05-11T20:59:55.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57892",
      "date": "2026-09-16",
      "epss": "0.0022",
      "percentile": "0.12645"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:19:54.000Z",
      "cve": "CVE-2024-57892",
      "id": "msrc_CVE-2024-57892",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57892.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57892\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:13.710\",\"lastModified\":\"2026-06-17T08:14:09.720\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\\n\\nWhen mounting ocfs2 and then remounting it as read-only, a\\nslab-use-after-free occurs after the user uses a syscall to\\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u003edqi_priv is the\\ndangling pointer.\\n\\nDuring the remounting process, the pointer dqi_priv is freed but is never\\nset as null leaving it to be accessed.  Additionally, the read-only option\\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\\nnext quota, the function ocfs2_get_next_id is called and only checks the\\nquota usage flags and not the quota suspended flags.\\n\\nTo fix this, I set dqi_priv to null when it is freed after remounting with\\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\\n\\n[akpm@linux-foundation.org: coding-style cleanups]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ocfs2: se corrige slab-use-after-free debido al puntero colgante dqi_priv Al montar ocfs2 y luego volver a montarlo como de solo lectura, se produce un slab-use-after-free despu\u00e9s de que el usuario usa una llamada al sistema a quota_getnextquota. Espec\u00edficamente, sb_dqinfo(sb, type)-\u0026gt;dqi_priv es el puntero colgante. Durante el proceso de remontaje, el puntero dqi_priv se libera pero nunca se establece como nulo, dej\u00e1ndolo para que se pueda acceder a \u00e9l. Adem\u00e1s, la opci\u00f3n de solo lectura para remontaje establece el indicador DQUOT_SUSPENDED en lugar de establecer los indicadores DQUOT_USAGE_ENABLED. Adem\u00e1s, m\u00e1s adelante en el proceso de obtenci\u00f3n de la siguiente cuota, se llama a la funci\u00f3n ocfs2_get_next_id y solo verifica los indicadores de uso de cuota y no los indicadores de cuota suspendida. Para solucionar esto, establezco dqi_priv en nulo cuando se libera despu\u00e9s de volver a montar con solo lectura y pongo una marca de verificaci\u00f3n para DQUOT_SUSPENDED en ocfs2_get_next_id. [akpm@linux-foundation.org: limpiezas de estilo de codificaci\u00f3n]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ocfs2/quota_global.c\",\"fs/ocfs2/quota_local.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"58f9e20e2a7602e1dd649a1ec4790077c251cb6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"8ff6f635a08c30559ded0c110c7ce03ba7747d11\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"f44e6d70c100614c211703f065cad448050e4a0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"2d431192486367eee03cc28d0b53b97dafcb8e63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"2e3d203b1adede46bbba049e497765d67865be18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"ba950a02d8d23811aa1120affd3adedcfac6153d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f9e8f5fcc059a3cba87ce837c88316797ef3645\",\"lessThan\":\"5f3fd772d152229d94602bca243fbb658068a597\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ocfs2/quota_global.c\",\"fs/ocfs2/quota_local.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.290\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.177\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.125\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.9\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-13T13:55:16.692610Z\",\"id\":\"CVE-2024-57892\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.6\",\"versionEndExcluding\":\"6.1.125\",\"matchCriteriaId\":\"0059FB9D-6155-40A5-865D-6501E6450D1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"51E6CFF2-92AA-4936-95AB-2D068168A696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"1D13AF97-FFED-4B68-906D-CFE38D0B88DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d431192486367eee03cc28d0b53b97dafcb8e63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e3d203b1adede46bbba049e497765d67865be18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/58f9e20e2a7602e1dd649a1ec4790077c251cb6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f3fd772d152229d94602bca243fbb658068a597\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ff6f635a08c30559ded0c110c7ce03ba7747d11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba950a02d8d23811aa1120affd3adedcfac6153d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f44e6d70c100614c211703f065cad448050e4a0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T13:55:56+00:00",
      "cve": "CVE-2024-57892",
      "id": "CVE-2024-57892",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57892.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:41:00Z",
      "cve": "CVE-2024-57892",
      "id": "CVE-2024-57892",
      "initial_release_date": "2025-01-16T03:49:13Z",
      "product_status:known_affected": "710",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57892",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57892.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57892\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-13T13:55:16.692610Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-13T13:55:18.253Z\"}}], \"cna\": {\"title\": \"ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"58f9e20e2a7602e1dd649a1ec4790077c251cb6c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"8ff6f635a08c30559ded0c110c7ce03ba7747d11\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"f44e6d70c100614c211703f065cad448050e4a0e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"2d431192486367eee03cc28d0b53b97dafcb8e63\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"2e3d203b1adede46bbba049e497765d67865be18\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"ba950a02d8d23811aa1120affd3adedcfac6153d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8f9e8f5fcc059a3cba87ce837c88316797ef3645\", \"lessThan\": \"5f3fd772d152229d94602bca243fbb658068a597\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ocfs2/quota_global.c\", \"fs/ocfs2/quota_local.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.290\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.177\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.125\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ocfs2/quota_global.c\", \"fs/ocfs2/quota_local.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/58f9e20e2a7602e1dd649a1ec4790077c251cb6c\"}, {\"url\": \"https://git.kernel.org/stable/c/8ff6f635a08c30559ded0c110c7ce03ba7747d11\"}, {\"url\": \"https://git.kernel.org/stable/c/f44e6d70c100614c211703f065cad448050e4a0e\"}, {\"url\": \"https://git.kernel.org/stable/c/2d431192486367eee03cc28d0b53b97dafcb8e63\"}, {\"url\": \"https://git.kernel.org/stable/c/2e3d203b1adede46bbba049e497765d67865be18\"}, {\"url\": \"https://git.kernel.org/stable/c/ba950a02d8d23811aa1120affd3adedcfac6153d\"}, {\"url\": \"https://git.kernel.org/stable/c/5f3fd772d152229d94602bca243fbb658068a597\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\\n\\nWhen mounting ocfs2 and then remounting it as read-only, a\\nslab-use-after-free occurs after the user uses a syscall to\\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u003edqi_priv is the\\ndangling pointer.\\n\\nDuring the remounting process, the pointer dqi_priv is freed but is never\\nset as null leaving it to be accessed.  Additionally, the read-only option\\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\\nnext quota, the function ocfs2_get_next_id is called and only checks the\\nquota usage flags and not the quota suspended flags.\\n\\nTo fix this, I set dqi_priv to null when it is freed after remounting with\\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\\n\\n[akpm@linux-foundation.org: coding-style cleanups]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.290\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.177\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.125\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.9\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T10:06:02.283Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57892\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T10:06:02.283Z\", \"dateReserved\": \"2025-01-11T14:45:42.028Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:05:44.635Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.