{"id":"DEBIAN-CVE-2024-49880","details":"In the Linux kernel, the following vulnerability has been resolved:  ext4: fix off by one issue in alloc_flex_gd()  Wesley reported an issue:  ================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Call Trace:  __ext4_ioctl+0x4e0/0x1800  ext4_ioctl+0x12/0x20  __x64_sys_ioctl+0x99/0xd0  x64_sys_call+0x1206/0x20d0  do_syscall_64+0x72/0x110  entry_SYSCALL_64_after_hwframe+0x76/0x7e ==================================================================  While reviewing the patch, Honza found that when adjusting resize_bg in alloc_flex_gd(), it was possible for flex_gd-\u003eresize_bg to be bigger than flexbg_size.  The reproduction of the problem requires the following:   o_group = flexbg_size * 2 * n;  o_size = (o_group + 1) * group_size;  n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)  o_size = (n_group + 1) * group_size;  Take n=0,flexbg_size=16 as an example:                last:15 |o---------------|--------------n-| o_group:0    resize to      n_group:30  The corresponding reproducer is:  img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M  Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE() to prevent the issue from happening again.  [ Note: another reproucer which this commit fixes is:    img=test.img   rm -f $img   truncate -s 25MiB $img   mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img   truncate -s 3GiB $img   dev=`losetup -f --show $img`   mkdir -p /tmp/test   mount $dev /tmp/test   resize2fs $dev 3G   umount $dev   losetup -d $dev    -- TYT ]","modified":"2026-09-15T09:03:19.822100497Z","published":"2024-10-21T18:15:10.373Z","upstream":["CVE-2024-49880"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-49880"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49880.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49880.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}