CVE-2024-50006

What it actually does

Incorrect unlock ordering of i_data_sem in ext4_ind_migrate() during EXT4_IOC_MIGRATE with O_SYNC can cause jbd2_log_wait_commit to deadlock under lockdep when racing with write(2), due to jbd2_might_wait_for_commit acquiring jbd2_handle while i_data_sem is held.

Why it matters to the business

Systems may experience kernel deadlocks or hangs during file migration operations on synchronously opened files, leading to service disruption; low practical risk outside debug kernels but requires urgent patching on affected Linux distributions due to kernel-wide exposure.

How an attack unfolds

An attacker with local access issues an EXT4_IOC_MIGRATE ioctl on a file opened O_SYNC while concurrently performing writes, triggering the lock order violation in jbd2_journal_stop that lockdep flags as a potential deadlock with jbd2_journal_start.

How to fix it

Update to Linux kernel containing commit 4192adefc9c570698821c5eb9873320eac2fcbf1 or later stable release; for Rocky Linux 8 apply fixed packages delve-1.6.0-1, golang-1.16.7-1, and go-toolset-1.16.7-1 from module el8.5.0+694.

How to confirm the fix worked

Verify kernel git commit 4192adefc9c570698821c5eb9873320eac2fcbf1 is present; recompile with CONFIG_PROVE_LOCKING and confirm absence of lockdep warnings on EXT4_IOC_MIGRATE + O_SYNC + write races; check package versions match listed fixed releases.

Typical attack path

1. Obtain local user access on affected Linux system
2. Open target file with O_SYNC flag
3. Issue EXT4_IOC_MIGRATE ioctl requiring synchronous update
4. Race with concurrent write(2) system call on same file
5. Trigger jbd2_log_wait_commit path leading to deadlock under CONFIG_PROVE_LOCKING

How to detect it

Inspect kernel logs for lockdep warnings mentioning i_data_sem and jbd2_handle; search dmesg or journalctl for jbd2_log_wait_commit stalls during ext4 migration ioctls; correlate with processes issuing EXT4_IOC_MIGRATE on O_SYNC descriptors.

What your security team should do

• Prioritize kernel upgrade to fixed commit or Rocky Linux packages within 30 days
• Disable unnecessary EXT4_IOC_MIGRATE usage in production workloads until patched
• Monitor for kernel oops or hung tasks related to jbd2_journal_stop
• Review systems for CONFIG_PROVE_LOCKING in debug builds and remove from production