CVE-2024-42304

Summary

In the Linux kernel, the following vulnerability has been resolved:

ext4: make sure the first directory block is not a hole

The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow.

ext4_mknod
 ...
  ext4_add_entry
    // Read block 0
    ext4_read_dirblock(dir, block, DIRENT)
      bh = ext4_bread(NULL, inode, block, 0)
      if (!bh && (type == INDEX || type == DIRENT_HTREE))
      // The first directory block is a hole
      // But type == DIRENT, so no error is reported.

After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.

Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3a17ca864baffc0c6f6e8aad525aa4365775a193 < d81d7e347d1f1f48a5634607d39eb90c161c8afeaffected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < e02f9941e8c011aa3eafa799def6a134ce06bcfaaffected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < de2a011a13a46468a6e8259db58b1b62071fe136affected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < 9771e3d8365ae1dd5e8846a204cb9af14e3e656aaffected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < b609753cbbd38f8c0affd4956c0af178348523acaffected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < c3893d9de8ee153baac56d127d844103488133b5affected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < 299bc6ffa57e04e74c6cce866d6c0741fb4897a1affected
LinuxLinux4e19d6b65fb4fc42e352ce9883649e049da14743 < f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6affected
LinuxLinux3f0307b0d2d8b333a6964fc4c820dc86896fd1cfaffected
LinuxLinux514631c2225c1fd556c799cc1893fb27b0f48f00affected
LinuxLinux7f1f86276515f6816a98f6ca3ef99c827d54642faffected
LinuxLinux5021b7a5bdd6bb859eb648c3da71cdd6aae1d133affected
LinuxLinux4.19.62 < 4.19.320affected
LinuxLinux4.9.187 < 4.10affected
LinuxLinux4.14.135 < 4.15affected
LinuxLinux5.1.21 < 5.2affected
LinuxLinux5.2.4 < 5.3affected
LinuxLinux5.3affected
LinuxLinux0 < 5.3unaffected
LinuxLinux4.19.320 <= 4.19.*unaffected
LinuxLinux5.4.282 <= 5.4.*unaffected
LinuxLinux5.10.224 <= 5.10.*unaffected
LinuxLinux5.15.165 <= 5.15.*unaffected
LinuxLinux6.1.103 <= 6.1.*unaffected
LinuxLinux6.6.44 <= 6.6.*unaffected
LinuxLinux6.10.3 <= 6.10.*unaffected
LinuxLinux6.11 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

Additional References

References