Slab Use-After-Free Vulnerability in Linux Kernel's OCFS2 Management

CVE-2024-57892

Summary

A vulnerability exists in the Linux kernel related to the OCFS2 file system, where a slab-use-after-free can occur during the remounting process. This happens when the user invokes a syscall to quota_getnextquota after mounting OCFS2 and subsequently remounting it as read-only. The root cause is the dangling pointer dqi_priv, which is freed during remounting but not set to null. As a result, this pointer remains accessible, potentially leading to undefined behavior and system stability issues. A fix has been implemented by ensuring that dqi_priv is set to null upon freeing and adding checks for the DQUOT_SUSPENDED flag during a quota retrieval operation.

References