CVE-2024-49966

What it actually does

Use-after-free in ocfs2 quota handling: ocfs2_global_read_info schedules dqi_sync_work but fails to cancel it before freeing oinfo on error paths after successful global quota read, leaving an active timer_list object.

Why it matters to the business

Local attackers on OCFS2 filesystems with quotas enabled can trigger kernel warnings, crashes, or potential privilege escalation leading to system downtime or compromise; widespread kernel exposure increases urgency for patching.

How an attack unfolds

An attacker with local access triggers the error path in ocfs2_global_read_info after dqi_sync_work is scheduled, causing the oinfo object to be freed while the delayed work remains active, resulting in use-after-free conditions exploitable for code execution or denial of service.

How to fix it

Upgrade Linux kernel to commit fc5cc716dfbdc5fd5f373ff3b51358174cf88bfc or later stable releases that cancel dqi_sync_work before freeing oinfo and return proper status on read_file_info failure; apply equivalent fixed packages for affected distributions.

How to confirm the fix worked

Verify kernel version includes the fix commit; enable CONFIG_DEBUG_OBJECTS and exercise quota mount/error paths to confirm absence of active timer warnings; review dmesg for resolved ODEBUG messages.

Typical attack path

1. Obtain local user access on target system
2. Interact with OCFS2 filesystem configured with quotas
3. Trigger error condition in .read_file_info after global quota initialization
4. Force freeing of oinfo while dqi_sync_work timer remains active
5. Exploit resulting use-after-free for kernel memory corruption or control flow hijack

How to detect it

Search kernel logs and dmesg for ODEBUG warnings referencing free active object, timer_list, and qsync_work_fn; monitor for ocfs2 quota initialization failures followed by crashes; correlate with local OCFS2 mount activity in audit logs.

• ODEBUG: free active (active state 0) object
• object type: timer_list hint: qsync_work_fn
• ocfs2_global_read_info
• dqi_sync_work

What your security team should do

• Immediately apply kernel updates to fixed versions across all OCFS2 deployments
• Prioritize systems with quota-enabled OCFS2 volumes due to local attack surface
• Monitor for kernel oops or ODEBUG warnings indicating potential exploitation attempts
• Restrict local access and quota configuration where feasible until patched