GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49880 (GCVE-0-2024-49880)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-05-11 20:41
VLAI
Title
ext4: fix off by one issue in alloc_flex_gd()
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in alloc_flex_gd() Wesley reported an issue: ================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Call Trace: __ext4_ioctl+0x4e0/0x1800 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0x99/0xd0 x64_sys_call+0x1206/0x20d0 do_syscall_64+0x72/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== While reviewing the patch, Honza found that when adjusting resize_bg in alloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than flexbg_size. The reproduction of the problem requires the following: o_group = flexbg_size * 2 * n; o_size = (o_group + 1) * group_size; n_group: [o_group + flexbg_size, o_group + flexbg_size * 2) o_size = (n_group + 1) * group_size; Take n=0,flexbg_size=16 as an example: last:15 |o---------------|--------------n-| o_group:0 resize to n_group:30 The corresponding reproducer is: img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE() to prevent the issue from happening again. [ Note: another reproucer which this commit fixes is: img=test.img rm -f $img truncate -s 25MiB $img mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img truncate -s 3GiB $img dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 3G umount $dev losetup -d $dev -- TYT ]
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:45 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 665d3e0af4d35acf9a5f58dfd471bc27dbf55880 , < 0d80d2b8bf613398baf7185009e35f9d0459ecb0 (git)
Affected: 665d3e0af4d35acf9a5f58dfd471bc27dbf55880 , < acb559d6826116cc113598640d105094620c2526 (git)
Affected: 665d3e0af4d35acf9a5f58dfd471bc27dbf55880 , < 6121258c2b33ceac3d21f6a221452692c465df88 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:45:46.406029Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:50.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d80d2b8bf613398baf7185009e35f9d0459ecb0",
              "status": "affected",
              "version": "665d3e0af4d35acf9a5f58dfd471bc27dbf55880",
              "versionType": "git"
            },
            {
              "lessThan": "acb559d6826116cc113598640d105094620c2526",
              "status": "affected",
              "version": "665d3e0af4d35acf9a5f58dfd471bc27dbf55880",
              "versionType": "git"
            },
            {
              "lessThan": "6121258c2b33ceac3d21f6a221452692c465df88",
              "status": "affected",
              "version": "665d3e0af4d35acf9a5f58dfd471bc27dbf55880",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off by one issue in alloc_flex_gd()\n\nWesley reported an issue:\n\n==================================================================\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\n------------[ cut here ]------------\nkernel BUG at fs/ext4/resize.c:324!\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\nCall Trace:\n __ext4_ioctl+0x4e0/0x1800\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0x99/0xd0\n x64_sys_call+0x1206/0x20d0\n do_syscall_64+0x72/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\nalloc_flex_gd(), it was possible for flex_gd-\u003eresize_bg to be bigger than\nflexbg_size.\n\nThe reproduction of the problem requires the following:\n\n o_group = flexbg_size * 2 * n;\n o_size = (o_group + 1) * group_size;\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\n o_size = (n_group + 1) * group_size;\n\nTake n=0,flexbg_size=16 as an example:\n\n              last:15\n|o---------------|--------------n-|\no_group:0    resize to      n_group:30\n\nThe corresponding reproducer is:\n\nimg=test.img\nrm -f $img\ntruncate -s 600M $img\nmkfs.ext4 -F $img -b 1024 -G 16 8M\ndev=`losetup -f --show $img`\nmkdir -p /tmp/test\nmount $dev /tmp/test\nresize2fs $dev 248M\n\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\nto prevent the issue from happening again.\n\n[ Note: another reproucer which this commit fixes is:\n\n  img=test.img\n  rm -f $img\n  truncate -s 25MiB $img\n  mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\n  truncate -s 3GiB $img\n  dev=`losetup -f --show $img`\n  mkdir -p /tmp/test\n  mount $dev /tmp/test\n  resize2fs $dev 3G\n  umount $dev\n  losetup -d $dev\n\n  -- TYT ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:41:01.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d80d2b8bf613398baf7185009e35f9d0459ecb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/acb559d6826116cc113598640d105094620c2526"
        },
        {
          "url": "https://git.kernel.org/stable/c/6121258c2b33ceac3d21f6a221452692c465df88"
        }
      ],
      "title": "ext4: fix off by one issue in alloc_flex_gd()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49880",
    "datePublished": "2024-10-21T18:01:18.790Z",
    "dateReserved": "2024-10-21T12:17:06.021Z",
    "dateUpdated": "2026-05-11T20:41:01.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49880",
      "date": "2026-09-16",
      "epss": "0.00244",
      "percentile": "0.15793"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"0E3AE738-A62B-4806-9D9C-933998214C6A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix off by one issue in alloc_flex_gd()\\n\\nWesley reported an issue:\\n\\n==================================================================\\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\\n------------[ cut here ]------------\\nkernel BUG at fs/ext4/resize.c:324!\\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\\nCall Trace:\\n __ext4_ioctl+0x4e0/0x1800\\n ext4_ioctl+0x12/0x20\\n __x64_sys_ioctl+0x99/0xd0\\n x64_sys_call+0x1206/0x20d0\\n do_syscall_64+0x72/0x110\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n==================================================================\\n\\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\\nalloc_flex_gd(), it was possible for flex_gd-\u003eresize_bg to be bigger than\\nflexbg_size.\\n\\nThe reproduction of the problem requires the following:\\n\\n o_group = flexbg_size * 2 * n;\\n o_size = (o_group + 1) * group_size;\\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\\n o_size = (n_group + 1) * group_size;\\n\\nTake n=0,flexbg_size=16 as an example:\\n\\n              last:15\\n|o---------------|--------------n-|\\no_group:0    resize to      n_group:30\\n\\nThe corresponding reproducer is:\\n\\nimg=test.img\\nrm -f $img\\ntruncate -s 600M $img\\nmkfs.ext4 -F $img -b 1024 -G 16 8M\\ndev=`losetup -f --show $img`\\nmkdir -p /tmp/test\\nmount $dev /tmp/test\\nresize2fs $dev 248M\\n\\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\\nto prevent the issue from happening again.\\n\\n[ Note: another reproucer which this commit fixes is:\\n\\n  img=test.img\\n  rm -f $img\\n  truncate -s 25MiB $img\\n  mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\\n  truncate -s 3GiB $img\\n  dev=`losetup -f --show $img`\\n  mkdir -p /tmp/test\\n  mount $dev /tmp/test\\n  resize2fs $dev 3G\\n  umount $dev\\n  losetup -d $dev\\n\\n  -- TYT ]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: correcci\\u00f3n de un problema en alloc_flex_gd() Wesley inform\\u00f3 de un problema: ======================================================================= EXT4-fs (dm-5): cambio de tama\\u00f1o del sistema de archivos de 7168 a 786432 bloques ------------[ corte aqu\\u00ed ]------------ \\u00a1ERROR del kernel en fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs No contaminado 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Rastreo de llamadas: __ext4_ioctl+0x4e0/0x1800 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0x99/0xd0 x64_sys_call+0x1206/0x20d0 do_syscall_64+0x72/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e == ... Tome n=0,flexbg_size=16 como ejemplo: last:15 |o---------------|--------------n-| o_group:0 redimensionar a n_group:30 El reproductor correspondiente es: img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M Elimine el problema m\\u00e1s 1 para solucionar el problema y agregue un WARN_ON_ONCE() para evitar que el problema vuelva a ocurrir. [ Nota: otro reprocesador que esta confirmaci\\u00f3n corrige es: img=test.img rm -f $img truncate -s 25MiB $img mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img truncate -s 3GiB $img dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 3G umount $dev losetup -d $dev -- TYT ]\"}]",
      "id": "CVE-2024-49880",
      "lastModified": "2024-10-25T14:42:58.203",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T18:15:10.373",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0d80d2b8bf613398baf7185009e35f9d0459ecb0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6121258c2b33ceac3d21f6a221452692c465df88\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/acb559d6826116cc113598640d105094620c2526\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-193\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49880\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:10.373\",\"lastModified\":\"2026-06-17T08:00:38.810\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix off by one issue in alloc_flex_gd()\\n\\nWesley reported an issue:\\n\\n==================================================================\\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\\n------------[ cut here ]------------\\nkernel BUG at fs/ext4/resize.c:324!\\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\\nCall Trace:\\n __ext4_ioctl+0x4e0/0x1800\\n ext4_ioctl+0x12/0x20\\n __x64_sys_ioctl+0x99/0xd0\\n x64_sys_call+0x1206/0x20d0\\n do_syscall_64+0x72/0x110\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n==================================================================\\n\\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\\nalloc_flex_gd(), it was possible for flex_gd-\u003eresize_bg to be bigger than\\nflexbg_size.\\n\\nThe reproduction of the problem requires the following:\\n\\n o_group = flexbg_size * 2 * n;\\n o_size = (o_group + 1) * group_size;\\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\\n o_size = (n_group + 1) * group_size;\\n\\nTake n=0,flexbg_size=16 as an example:\\n\\n              last:15\\n|o---------------|--------------n-|\\no_group:0    resize to      n_group:30\\n\\nThe corresponding reproducer is:\\n\\nimg=test.img\\nrm -f $img\\ntruncate -s 600M $img\\nmkfs.ext4 -F $img -b 1024 -G 16 8M\\ndev=`losetup -f --show $img`\\nmkdir -p /tmp/test\\nmount $dev /tmp/test\\nresize2fs $dev 248M\\n\\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\\nto prevent the issue from happening again.\\n\\n[ Note: another reproucer which this commit fixes is:\\n\\n  img=test.img\\n  rm -f $img\\n  truncate -s 25MiB $img\\n  mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\\n  truncate -s 3GiB $img\\n  dev=`losetup -f --show $img`\\n  mkdir -p /tmp/test\\n  mount $dev /tmp/test\\n  resize2fs $dev 3G\\n  umount $dev\\n  losetup -d $dev\\n\\n  -- TYT ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: correcci\u00f3n de un problema en alloc_flex_gd() Wesley inform\u00f3 de un problema: ======================================================================= EXT4-fs (dm-5): cambio de tama\u00f1o del sistema de archivos de 7168 a 786432 bloques ------------[ corte aqu\u00ed ]------------ \u00a1ERROR del kernel en fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs No contaminado 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Rastreo de llamadas: __ext4_ioctl+0x4e0/0x1800 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0x99/0xd0 x64_sys_call+0x1206/0x20d0 do_syscall_64+0x72/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e == ... Tome n=0,flexbg_size=16 como ejemplo: last:15 |o---------------|--------------n-| o_group:0 redimensionar a n_group:30 El reproductor correspondiente es: img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M Elimine el problema m\u00e1s 1 para solucionar el problema y agregue un WARN_ON_ONCE() para evitar que el problema vuelva a ocurrir. [ Nota: otro reprocesador que esta confirmaci\u00f3n corrige es: img=test.img rm -f $img truncate -s 25MiB $img mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img truncate -s 3GiB $img dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 3G umount $dev losetup -d $dev -- TYT ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/resize.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\",\"lessThan\":\"0d80d2b8bf613398baf7185009e35f9d0459ecb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\",\"lessThan\":\"acb559d6826116cc113598640d105094620c2526\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\",\"lessThan\":\"6121258c2b33ceac3d21f6a221452692c465df88\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/resize.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:45:46.406029Z\",\"id\":\"CVE-2024-49880\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"0E3AE738-A62B-4806-9D9C-933998214C6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d80d2b8bf613398baf7185009e35f9d0459ecb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6121258c2b33ceac3d21f6a221452692c465df88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/acb559d6826116cc113598640d105094620c2526\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:14:04+00:00",
      "cve": "CVE-2024-49880",
      "id": "CVE-2024-49880",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix off by one issue in alloc_flex_gd()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49880.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:29:58Z",
      "cve": "CVE-2024-49880",
      "id": "CVE-2024-49880",
      "initial_release_date": "2024-10-24T03:19:04Z",
      "product_status:known_not_affected": "498",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49880",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49880.json",
      "version": "23"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49880\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:45:46.406029Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:45:49.949Z\"}}], \"cna\": {\"title\": \"ext4: fix off by one issue in alloc_flex_gd()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\", \"lessThan\": \"0d80d2b8bf613398baf7185009e35f9d0459ecb0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\", \"lessThan\": \"acb559d6826116cc113598640d105094620c2526\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"665d3e0af4d35acf9a5f58dfd471bc27dbf55880\", \"lessThan\": \"6121258c2b33ceac3d21f6a221452692c465df88\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/resize.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/resize.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0d80d2b8bf613398baf7185009e35f9d0459ecb0\"}, {\"url\": \"https://git.kernel.org/stable/c/acb559d6826116cc113598640d105094620c2526\"}, {\"url\": \"https://git.kernel.org/stable/c/6121258c2b33ceac3d21f6a221452692c465df88\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix off by one issue in alloc_flex_gd()\\n\\nWesley reported an issue:\\n\\n==================================================================\\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\\n------------[ cut here ]------------\\nkernel BUG at fs/ext4/resize.c:324!\\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\\nCall Trace:\\n __ext4_ioctl+0x4e0/0x1800\\n ext4_ioctl+0x12/0x20\\n __x64_sys_ioctl+0x99/0xd0\\n x64_sys_call+0x1206/0x20d0\\n do_syscall_64+0x72/0x110\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n==================================================================\\n\\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\\nalloc_flex_gd(), it was possible for flex_gd-\u003eresize_bg to be bigger than\\nflexbg_size.\\n\\nThe reproduction of the problem requires the following:\\n\\n o_group = flexbg_size * 2 * n;\\n o_size = (o_group + 1) * group_size;\\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\\n o_size = (n_group + 1) * group_size;\\n\\nTake n=0,flexbg_size=16 as an example:\\n\\n              last:15\\n|o---------------|--------------n-|\\no_group:0    resize to      n_group:30\\n\\nThe corresponding reproducer is:\\n\\nimg=test.img\\nrm -f $img\\ntruncate -s 600M $img\\nmkfs.ext4 -F $img -b 1024 -G 16 8M\\ndev=`losetup -f --show $img`\\nmkdir -p /tmp/test\\nmount $dev /tmp/test\\nresize2fs $dev 248M\\n\\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\\nto prevent the issue from happening again.\\n\\n[ Note: another reproucer which this commit fixes is:\\n\\n  img=test.img\\n  rm -f $img\\n  truncate -s 25MiB $img\\n  mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\\n  truncate -s 3GiB $img\\n  dev=`losetup -f --show $img`\\n  mkdir -p /tmp/test\\n  mount $dev /tmp/test\\n  resize2fs $dev 3G\\n  umount $dev\\n  losetup -d $dev\\n\\n  -- TYT ]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:40:14.543Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49880\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:40:14.543Z\", \"dateReserved\": \"2024-10-21T12:17:06.021Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:18.790Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.