CVE-2024-57892

What it actually does

Use-after-free in ocfs2 quota handling where dqi_priv pointer is freed on read-only remount but not nulled, and ocfs2_get_next_id only checks DQUOT_USAGE_ENABLED instead of also checking DQUOT_SUSPENDED, allowing later quota_getnextquota syscall to dereference the dangling pointer.

Why it matters to the business

Systems using ocfs2 filesystems with quotas can experience crashes or memory corruption during routine administrative quota operations after a read-only remount, leading to unplanned downtime and potential data integrity issues on affected Linux deployments.

How an attack unfolds

An attacker with local access mounts an ocfs2 filesystem, triggers a remount to read-only (freeing dqi_priv without nulling it and setting DQUOT_SUSPENDED), then invokes the quota_getnextquota syscall; ocfs2_get_next_id skips the suspended flag check and accesses the freed memory, resulting in slab use-after-free.

How to fix it

Apply the upstream fix that nulls dqi_priv after freeing on read-only remount and adds a DQUOT_SUSPENDED check in ocfs2_get_next_id; upgrade to a kernel containing the resolution for CVE-2024-57892.

How to confirm the fix worked

Confirm the patched kernel is running, reproduce the mount/remount sequence followed by quota_getnextquota without triggering use-after-free, and verify dqi_priv is nulled and suspended flag is respected in source or via targeted testing.

Typical attack path

1. Mount ocfs2 filesystem with quota support enabled
2. Remount the filesystem read-only
3. Invoke quota_getnextquota syscall or equivalent quota enumeration
4. Trigger access to freed dqi_priv pointer in ocfs2_get_next_id

How to detect it

Review kernel logs for slab-use-after-free reports involving ocfs2 or dqi_priv after remount operations; inspect audit logs for sequences of mount, remount-ro, and quota syscalls on ocfs2 filesystems.

What your security team should do

• Prioritize kernel updates on any systems exposing ocfs2 volumes with quotas
• Audit for ocfs2 usage in environments where read-only remounts occur
• Monitor for future Linux kernel quota-related patches