CVE-2024-35807

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix corruption during on-line resize

We observed a corruption during on-line resize of a file system that is

larger than 16 TiB with 4k block size. With having more then 2^32 blocks

resize_inode is turned off by default by mke2fs. The issue can be

reproduced on a smaller file system for convenience by explicitly

turning off resize_inode. An on-line resize across an 8 GiB boundary (the

size of a meta block group in this setup) then leads to a corruption:

dev=/dev/<some_dev> # should be >= 16 GiB

mkdir -p /corruption

/sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))

mount -t ext4 $dev /corruption

dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))

sha1sum /corruption/test

# 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test

/sbin/resize2fs $dev $((2*2**21))

# drop page cache to force reload the block from disk

echo 1 > /proc/sys/vm/drop_c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References