Microsoft security update for CVE-2024-50217
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-50217. This page also shows what EchelonGraph holds for CVE-2024-50217, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products28
- azl3 kernel 6.6.104.2-4 on Azure Linux 3.0
- azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
- azl3 kernel 6.6.117.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
- azl3 kernel 6.6.119.3-3 on Azure Linux 3.0
- azl3 kernel 6.6.121.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.126.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.130.1-3 on Azure Linux 3.0
- azl3 kernel 6.6.134.1-2 on Azure Linux 3.0
- azl3 kernel 6.6.137.1-2 on Azure Linux 3.0
- azl3 kernel 6.6.138.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.139.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.141.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.143.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.144.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.145.2-1 on Azure Linux 3.0
- azl3 kernel 6.6.150.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.152.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.157.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.159.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.161.1-1 on Azure Linux 3.0
- azl3 kernel 6.6.96.2-1 on Azure Linux 3.0
- azl3 kernel 6.6.96.2-2 on Azure Linux 3.0
- cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0
- cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0
- cbl2 kernel 5.15.202.1-1
- cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0
- cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
✅ Updates Microsoft lists: 1 update
1 row: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | — |
🧭 EchelonGraph on CVE-2024-50217
- EchelonGraph score
- 7.8 HIGH
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details: 1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 → loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, // which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file) fput(btrfs_device_1->bdev_file) // UAF ! Fix it by setting 'device->bdev_file' as 'NULL' after closing the btrfs_device in btrfs_close_one_device().
Published by kernel.org, the CVE Numbering Authority that assigned CVE-2024-50217, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).