CVE-2024-40955

What it actually does

Slab-out-of-bounds read in ext4_mb_find_good_group_avg_frag_lists due to s_mb_group_prealloc set to an oversized value (e.g., 2147483647) causing mb_avg_fragment_size_order to compute an index (29) beyond the 14-element s_mb_avg_fragment_size array for 4k blocks.

Why it matters to the business

Kernel memory corruption risk on ext4 filesystems can lead to crashes, data corruption, or potential privilege escalation; high-urgency patching required for any Linux systems running affected kernels, especially those exposing sysfs controls.

How an attack unfolds

An attacker with write access to the ext4 sysfs mb_group_prealloc tunable sets an extreme value; subsequent file writes trigger ext4_mb_new_blocks -> ext4_mb_regular_allocator -> ext4_mb_choose_next_group_best_avail -> mb_avg_fragment_size_order returning order 29, resulting in out-of-bounds access to the fragment list.

How to fix it

Upgrade the Linux kernel to a version containing the fix that adds the attr_clusters_in_group attribute bound check and caps mb_avg_fragment_size_order() return value at MB_NUM_ORDERS(sb); avoid exposing or using extreme mb_group_prealloc values until patched.

How to confirm the fix worked

Confirm kernel version includes the ext4_mb_find_good_group_avg_frag_lists bounds fix; test by attempting to set mb_group_prealloc above s_clusters_per_group and verifying no KASAN reports or crashes occur on allocation.

Typical attack path

1. Obtain ability to write to /sys/fs/ext4/<disk>/mb_group_prealloc
2. Echo oversized value (2147483647) into the tunable
3. Perform file write or allocation that invokes ext4_mb_new_blocks on the filesystem
4. ext4_mb_normalize_request sets ac_g_ex.fe_len from the tunable
5. ext4_mb_find_good_group_avg_frag_lists performs invalid array access triggering KASAN slab-out-of-bounds

How to detect it

Search kernel logs for KASAN slab-out-of-bounds reports mentioning ext4_mb_find_good_group_avg_frag_lists or ext4_mb_regular_allocator; inspect sysfs audit logs for writes of large values to mb_group_prealloc; look for ext4 allocation failures coinciding with kworker activity.

• ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200
• BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists
• mb_group_prealloc

What your security team should do

• Immediately identify and patch all systems running vulnerable ext4 kernels
• Restrict sysfs write access to ext4 tunables via mandatory access controls
• Monitor for ext4 allocation-related kernel oops or KASAN reports in production workloads
• Prioritize patching on high-value or internet-facing Linux servers due to memory corruption impact