Amazon Linux AMI: CVE-2024-49884: Security patch for kernel (ALAS-2025-1957)

Amazon Linux AMI: CVE-2024-49884: Security patch for kernel (ALAS-2025-1957)

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

10/21/2024

Created

02/11/2025

Added

02/06/2025

Modified

02/06/2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix slab-use-after-free in ext4_split_extent_at()

We hit the following use-after-free:

==================================================================

BUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0

Read of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40

CPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724

Call Trace:

<TASK>

kasan_report+0x93/0xc0

ext4_split_extent_at+0xba8/0xcc0

ext4_split_extent.isra.0+0x18f/0x500

ext4_split_convert_extents+0x275/0x750

ext4_ext_handle_unwritten_extents+0x73e/0x1580

ext4_ext_map_blocks+0xe20/0x2dc0

ext4_map_blocks+0x724/0x1700

ext4_do_writepages+0x12d6/0x2a70

[...]

Allocated by task 40:

__kmalloc_noprof+0x1ac/0x480

ext4_find_extent+0xf3b/0x1e70

ext4_ext_map_blocks+0x188/0x2dc0

ext4_map_blocks+0x724/0x1700

ext4_do_writepages+0x12d6/0x2a70

[...]

Freed by task 40:

kfree+0xf1/0x2b0

ext4_find_extent+0xa71/0x1e70

ext4_ext_insert_extent+0xa22/0x3260

ext4_split_extent_at+0x3ef/0xcc0

ext4_split_extent.isra.0+0x18f/0x500

ext4_split_convert_extents+0x275/0x750

ext4_ext_handle_unwritten_extents+0x73e/0x1580

ext4_ext_map_blocks+0xe20/0x2dc0

ext4_map_blocks+0x724/0x1700

ext4_do_writepages+0x12d6/0x2a70

[...]

==================================================================

The flow of issue triggering is as follows:

ext4_split_extent_at

path = *ppath

ext4_ext_insert_extent(ppath)

ext4_ext_create_new_leaf(ppath)

ext4_find_extent(orig_path)

path = *orig_path

read_extent_tree_block

// return -ENOMEM or -EIO

ext4_free_ext_path(path)

kfree(path)

*orig_path = NULL

a. If err is -ENOMEM:

ext4_ext_dirty(path + path->p_depth)

// path use-after-free !!!

b. If err is -EIO and we have EXT_DEBUG defined:

ext4_ext_show_leaf(path)

eh = path[depth].p_hdr

// path also use-after-free !!!

So when trying to zeroout or fix the extent length, call ext4_find_extent()

to update the path.

In addition we use *ppath directly as an ext4_ext_show_leaf() input to

avoid possible use-after-free when EXT_DEBUG is defined, and to avoid

unnecessary path updates.

Solution(s)

• amazon-linux-upgrade-kernel

References

• ALAS-2025-1957
• CVE-2024-49884