CVE-2024-50015

What it actually does

The vulnerability allows dax_iomap_rw() to update inode size with partial writes when a fatal signal interrupts the operation after extent allocation but before full data copy completes, resulting in written extents that exceed the recorded inode size.

Why it matters to the business

Systems using DAX on ext4 filesystems may encounter filesystem inconsistency errors during routine checks, leading to unplanned downtime, manual recovery efforts, or potential service disruption in storage-heavy environments.

How an attack unfolds

An attacker with local access writes a large file using DAX on ext4, then triggers a fatal signal during the second iomap iteration after extents are marked written but before inode size is fully updated, causing fsck to report size mismatches on subsequent filesystem verification.

How to fix it

Update to fixed kernel versions containing commit f8a7c342326f6ad1dfdb30a18dd013c70f5e9669 or apply the corresponding Rocky Linux package updates: mod_md 1:2.0.8-8.module+el8.5.0+695+1fa8055e, httpd 0:2.4.37-41.module+el8.5.0+695+1fa8055e, mod_http2 0:1.15.7-3.module+el8.4.0+553+7a69454b.

How to confirm the fix worked

Verify kernel or package versions match the fixed releases, then create and interrupt a DAX write workload while monitoring for fsck inode size mismatch reports.

Typical attack path

1. Obtain local user access on a system with ext4 DAX enabled
2. Perform a large write operation that spans multiple extent allocations
3. Interrupt the process with a fatal signal after partial data copy and extent marking
4. Trigger filesystem check which detects inode size smaller than allocated extents

How to detect it

Review fsck output and system logs for inode size mismatch messages after writes to DAX files; correlate with process termination events during large file operations on ext4.

• Inode *, i_size is *, should be *
• ext4_handle_inode_extension
• ext4_update_inode_size

What your security team should do

• Prioritize patching ext4 DAX systems within standard maintenance windows given low EPSS and no KEV listing
• Audit environments for DAX-enabled ext4 mounts and schedule filesystem consistency checks after upgrades
• Monitor for fsck failures indicating inode size discrepancies as an ongoing operational control