In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer. During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags. To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. [akpm@linux-foundation.org: coding-style cleanups]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/2d431192486367eee03cc28d0b53b97dafcb8e63 cve-icon cve-icon
https://git.kernel.org/stable/c/2e3d203b1adede46bbba049e497765d67865be18 cve-icon cve-icon
https://git.kernel.org/stable/c/58f9e20e2a7602e1dd649a1ec4790077c251cb6c cve-icon cve-icon
https://git.kernel.org/stable/c/5f3fd772d152229d94602bca243fbb658068a597 cve-icon cve-icon
https://git.kernel.org/stable/c/8ff6f635a08c30559ded0c110c7ce03ba7747d11 cve-icon cve-icon
https://git.kernel.org/stable/c/ba950a02d8d23811aa1120affd3adedcfac6153d cve-icon cve-icon
https://git.kernel.org/stable/c/f44e6d70c100614c211703f065cad448050e4a0e cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025011513-CVE-2024-57892-6d53@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-57892 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-57892 cve-icon
History

Thu, 13 Feb 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Feb 2025 01:00:00 +0000

Type Values Removed Values Added
Metrics threat_severity

Low

 threat_severity

Important

Sun, 02 Feb 2025 10:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
References

Tue, 21 Jan 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 17 Jan 2025 13:45:00 +0000

Type Values Removed Values Added
References

Thu, 16 Jan 2025 01:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 15 Jan 2025 13:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer. During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags. To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. [akpm@linux-foundation.org: coding-style cleanups]
Title ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-02-13T14:04:27.066Z

Reserved: 2025-01-11T14:45:42.028Z

Link: CVE-2024-57892

cve-icon Vulnrichment

Updated: 2025-02-13T13:55:18.253Z

cve-icon NVD

Status : Modified

Published: 2025-01-15T13:15:13.710

Modified: 2025-02-13T14:16:17.800

Link: CVE-2024-57892

cve-icon Redhat

Severity : Important

Publid Date: 2025-01-15T00:00:00Z

Links: CVE-2024-57892 - Bugzilla