CVE-2024-26704: ext4: fix double-free of blocks due to wrong extents moved_len
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix double-free of blocks due to wrong extents movedlen
In ext4moveextents(), movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not zero. When the loop fails to exit after successfully moving some extents, movedlen is not updated and remains at 0, so it does not discard the preallocations.
If the moved extents overlap with the preallocated extents, the overlapped extents are freed twice in ext4mbreleaseinodepa() and ext4processfreeddata() (as described in commit 94d7c16cbbbd ("ext4: Fix double-free of blocks with EXT4IOCMOVEEXT")), and bbfree is incremented twice. Hence when trim is executed, a zero-division bug is triggered in mbupdateavgfragmentsize() because bbfree is not zero and bbfragments is zero.
Therefore, update movelen after each extent move to avoid the issue.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix double-free of blocks due to wrong extents movedlen
The Linux kernel CVE team has assigned CVE-2024-26704 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040340-CVE-2024-26704-a082@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26704?
CVE-2024-26704 is considered a moderate severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2024-26704?
To mitigate CVE-2024-26704, update your Linux kernel to one of the patched versions listed, such as 4.19.307 or 5.4.269.
Which Linux kernel versions are affected by CVE-2024-26704?
CVE-2024-26704 affects multiple Linux kernel versions, specifically those prior to 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.79, and others.
What is the specific issue described in CVE-2024-26704?
CVE-2024-26704 involves a double-free of blocks in the ext4 file system due to incorrect management of moved_len in ext4_move_extents function.
Is my system vulnerable to CVE-2024-26704 if it's running an affected Linux kernel?
Yes, if your system is running an affected version of the Linux kernel that has not been updated, it is vulnerable to CVE-2024-26704.