Linux Kernel OCFS2 Slab-Use-After-Free Vulnerability in Quota Management

A slab-use-after-free vulnerability has been identified in the Linux kernel's OCFS2 file system. This issue arises when OCFS2 is mounted and then remounted as read-only. During this process, a dangling pointer, dqi_priv, is created after a syscall to quota_getnextquota is used. The pointer is freed during the remounting but not set to null, leading to unauthorized access. Additionally, the read-only remounting applies the DQUOT_SUSPENDED flag instead of the DQUOT_USAGE_ENABLED flag, causing further complications in quota management.

Impact

Exploitation of this vulnerability can lead to use-after-free conditions, potentially allowing for arbitrary code execution or memory corruption.