CVE-2024-49881

What it actually does

In ext4_find_extent, when the path array is insufficient for the extent depth the function frees the original allocation and sets *orig_path to NULL, then reallocates a new path without updating the caller's pointer; subsequent use of the stale pointer produces a NULL dereference or leaks the newly allocated path.

Why it matters to the business

Unprivileged local users can trigger kernel crashes that cause denial of service on affected Linux systems; in container and virtualization environments the issue can also affect multiple workloads sharing the host kernel, increasing operational disruption and recovery costs.

How an attack unfolds

An attacker with local access crafts filesystem operations (such as extent splitting during writes to uninitialized extents) that force ext4_find_extent to exceed the caller's path depth; the resulting NULL pointer is dereferenced inside ext4_split_extent_at, producing a kernel oops. Public exploit campaigns and actor tooling targeting similar Linux kernel memory issues could be adapted to this flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit ec0c0beb9b777cdd1edd7df9b36e0f3e67e2bdff or later; for Rocky Linux 8 apply the listed fixed package versions for podman, container-selinux, containernetworking-plugins and related modules; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the vulnerable release; run regression tests that exercise ext4 extent splitting and verify absence of NULL dereference crashes under fsstress or similar workloads.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Create or mount an ext4 filesystem image containing crafted extent metadata
3. Trigger repeated write or fallocate operations that invoke ext4_ext_handle_unwritten_extents
4. Force ext4_find_extent to reallocate its path array
5. Trigger NULL dereference in ext4_split_extent_at leading to kernel panic

How to detect it

Review kernel logs for BUG: kernel NULL pointer dereference entries referencing ext4_split_extent_at or ext4_find_extent; correlate with process activity involving ext4 extent operations and fsstress-like workloads.

What your security team should do

• Prioritize kernel updates on all systems exposing ext4 filesystems to untrusted users
• Apply the exact fixed package versions provided for Rocky Linux 8 container tooling
• Monitor for local privilege-escalation attempts until patches are deployed
• Reboot hosts after kernel updates to activate the corrected ext4 code paths