CVE-2024-49880

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off by one issue in alloc_flex_gd()

Wesley reported an issue:

==================================================================

EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks

------------[ cut here ]------------

kernel BUG at fs/ext4/resize.c:324!

CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27

RIP: 0010:ext4_resize_fs+0x1212/0x12d0

Call Trace:

__ext4_ioctl+0x4e0/0x1800

ext4_ioctl+0x12/0x20

__x64_sys_ioctl+0x99/0xd0

x64_sys_call+0x1206/0x20d0

do_syscall_64+0x72/0x110

entry_SYSCALL_64_after_hwframe+0x76/0x7e

==================================================================

While reviewing the patch, Honza found that when adjusting resize_bg in

alloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than

flexbg_size.

The reproduction of the problem requires the following:

o_group = flexbg_size * 2 * n;

o_size = (o_group + 1) * group_size;

n_group: [o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References