CVE-2024-49883

What it actually does

Use-after-free in ext4_ext_insert_extent() when ext4_ext_create_new_leaf() reallocates the path pointer via ext4_find_extent(), leaving callers with a stale reference that is later dereferenced for ext4 extent header access.

Why it matters to the business

Kernel memory corruption on Linux systems using ext4 can cause system crashes, data loss during writes, or local privilege escalation; high ecosystem prevalence in servers and containers increases operational disruption risk.

How an attack unfolds

An attacker with local access triggers repeated extent insertions during writeback on an ext4 filesystem; the race between path reallocation and reuse in ext4_ext_insert_extent() leads to a dangling pointer that is dereferenced, enabling slab UAF for memory corruption or code execution. Threat actor campaigns targeting Linux kernel flaws have demonstrated similar local exploitation patterns.

How to fix it

Upgrade the Linux kernel to commit e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1 or later; for Rocky Linux 8 apply nodejs-nodemon-1.18.3-1.module+el8.3.0+101+f84c7154 and nodejs-packaging-17-3.module+el8.3.0+101+f84c7154. Reboot after patching; consider disabling unneeded ext4 features or using a different filesystem as a temporary mitigation on unpatchable systems.

How to confirm the fix worked

Verify the running kernel contains commit e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1; attempt to reproduce the original KASAN trace with a crafted ext4 workload and confirm absence of the slab-use-after-free in ext4_ext_insert_extent; check package versions on Rocky Linux systems.

Typical attack path

1. Obtain local unprivileged access to a Linux system with ext4
2. Create or open files to trigger extent-based writes
3. Force writeback paths that invoke ext4_ext_map_blocks and ext4_ext_insert_extent
4. Trigger path reallocation inside ext4_ext_create_new_leaf to free the original path
5. Reuse the stale path pointer to read or write freed slab memory
6. Escalate via corrupted kernel structures or trigger denial of service

How to detect it

Search kernel logs and KASAN reports for 'BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent', stack traces containing ext4_ext_insert_extent+0x26d4, ext4_ext_create_new_leaf, and ext4_find_extent; inspect crash dumps for freed path pointers around 0x2000/0x3000 addresses and kworker writeback activity on ext4.

• BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent
• ext4_ext_insert_extent+0x26d4/0x3330
• ext4_ext_create_new_leaf
• ext4_find_extent+0x7c0/0x1f70
• Read of size 8 at addr ffff8881
• kworker/u.*:.*ext4_do_writepages

What your security team should do

• Immediately schedule kernel updates to the fixed commit across all ext4-using systems
• Prioritize patching for internet-facing or multi-tenant Linux hosts given local exploit potential
• Add kernel crash and KASAN monitoring rules for ext4_ext_insert_extent symbols
• Review and reduce local user access where possible until patches are deployed