CVE-2024-26772

ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

Places the logic for checking if the group's block bitmap is corrupt under
the protection of the group lock to avoid allocating blocks from the group
with a corrupted block bitmap.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: evita asignar bloques del grupo corrupto en ext4_mb_find_by_goal() Coloca la lógica para verificar si el mapa de bits del bloque del grupo está corrupto bajo la protección del bloqueo del grupo para evitar la asignación de bloques del grupo con un mapa de bits de bloque dañado.

A vulnerability was found in the ext4_mb_find_by_goal() function in the Linux kernel. This issue could lead to memory corruption or crashes due to the allocation of blocks from a group with a corrupted block bitmap.

*Credits: N/A

CVSS Scores

Red Hatv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-02-19 CVE Reserved
2024-04-03 CVE Published
2024-04-04 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-229: Improper Handling of Values

CAPEC

References (12)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43	2024-03-01
https://git.kernel.org/stable/c/6b92b1bc16d691c95b152c6dbf027ad64315668d	2024-03-01
https://git.kernel.org/stable/c/ffeb72a80a82aba59a6774b0611f792e0ed3b0b7	2024-03-01
https://git.kernel.org/stable/c/8de8305a25bfda607fc13475ebe84b978c96d7ff	2024-03-01
https://git.kernel.org/stable/c/d639102f4cbd4cb65d1225dba3b9265596aab586	2024-03-01
https://git.kernel.org/stable/c/d3bbe77a76bc52e9d4d0a120f1509be36e25c916	2024-03-01
https://git.kernel.org/stable/c/21dbe20589c7f48e9c5d336ce6402bcebfa6d76a	2024-03-01
https://git.kernel.org/stable/c/832698373a25950942c04a512daa652c18a9b513	2024-01-18

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-26772	2024-09-24
https://bugzilla.redhat.com/show_bug.cgi?id=2273242	2024-09-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.308 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.308"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.270 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.270"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.211 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.211"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.150 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.150"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.80 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.80"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.19 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.19"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.7.7 Search vendor "Linux" for product "Linux Kernel" and version " < 6.7.7"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.8 Search vendor "Linux" for product "Linux Kernel" and version " < 6.8"		en		Affected