CVE-2024-57892
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
Reported by linux · Published January 15, 2025
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer. During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags. To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. [akpm@linux-foundation.org: coding-style cleanups]
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | f44e6d70c100614c211703f065cad448050e4a0e, ba950a02d8d23811aa1120affd3adedcfac6153d, 8ff6f635a08c30559ded0c110c7ce03ba7747d11, 5f3fd772d152229d94602bca243fbb658068a597, 58f9e20e2a7602e1dd649a1ec4790077c251cb6c, 2e3d203b1adede46bbba049e497765d67865be18, 2d431192486367eee03cc28d0b53b97dafcb8e63 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 8f9e8f5fcc059a3cba87ce837c88316797ef3645, 8f9e8f5fcc059a3cba87ce837c88316797ef3645, 8f9e8f5fcc059a3cba87ce837c88316797ef3645 |
| Linux | Linux | 4.6, 0, 5.4.290 |
| Linux | Linux | 5.4.290, 5.15.177, 6.1.125 |
| linux | linux_kernel | 4.6, 4.6, 4.6 |
Timeline
- Jan 15, 2025 CVE Published
- Jan 16, 2025 EPSS Score (30 in total, the first dated here)
- Jan 21, 2025 Coalition ESS Score (12 in total, the first dated here)
- Dec 16, 2025 PoC Published
- Dec 29, 2025 Security Advisory (126 in total, the first dated here)
- Apr 29, 2026 Distribution Patch (101 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-57892
vulnetix vdb fixes CVE-2024-57892Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-57892/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart