CVE-2024-49960

{"id": "CVE-2024-49960", "cveTags": [], "metrics": {}, "published": "2024-10-21T18:15:17.187", "references": [{"url": "https://git.kernel.org/stable/c/0ce160c5bdb67081a62293028dc85758a8efb22a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9203817ba46ebba7c865c8de2aba399537b6e891", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b85569585d0154d4db1e4f9e3e6a4731d407feb0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fa78fb51d396f4f2f80f8e96a3b1516f394258be", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix timer use-after-free on failed mount\n\nSyzbot has found an ODEBUG bug in ext4_fill_super\n\nThe del_timer_sync function cancels the s_err_report timer,\nwhich reminds about filesystem errors daily. We should\nguarantee the timer is no longer active before kfree(sbi).\n\nWhen filesystem mounting fails, the flow goes to failed_mount3,\nwhere an error occurs when ext4_stop_mmpd is called, causing\na read I/O failure. This triggers the ext4_handle_error function\nthat ultimately re-arms the timer,\nleaving the s_err_report timer active before kfree(sbi) is called.\n\nFix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: fix timer use-after-free on failed mount Syzbot ha encontrado un error ODEBUG en ext4_fill_super La funci\u00f3n del_timer_sync cancela el temporizador s_err_report, que recuerda los errores del sistema de archivos a diario. Debemos garantizar que el temporizador ya no est\u00e9 activo antes de kfree(sbi). Cuando falla el montaje del sistema de archivos, el flujo va a failed_mount3, donde ocurre un error cuando se llama a ext4_stop_mmpd, lo que causa un error de E/S de lectura. Esto activa la funci\u00f3n ext4_handle_error que, en \u00faltima instancia, vuelve a armar el temporizador, dejando el temporizador s_err_report activo antes de que se llame a kfree(sbi). Solucione el problema cancelando el temporizador s_err_report despu\u00e9s de llamar a ext4_stop_mmpd."}], "lastModified": "2024-10-23T15:13:25.583", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}