| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42304: ext4: make sure the first directory block is not a hole |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: make sure the first directory block is not a hole |
| |
| The syzbot constructs a directory that has no dirblock but is non-inline, |
| i.e. the first directory block is a hole. And no errors are reported when |
| creating files in this directory in the following flow. |
| |
| ext4_mknod |
| ... |
| ext4_add_entry |
| // Read block 0 |
| ext4_read_dirblock(dir, block, DIRENT) |
| bh = ext4_bread(NULL, inode, block, 0) |
| if (!bh && (type == INDEX || type == DIRENT_HTREE)) |
| // The first directory block is a hole |
| // But type == DIRENT, so no error is reported. |
| |
| After that, we get a directory block without '.' and '..' but with a valid |
| dentry. This may cause some code that relies on dot or dotdot (such as |
| make_indexed_dir()) to crash. |
| |
| Therefore when ext4_read_dirblock() finds that the first directory block |
| is a hole report that the filesystem is corrupted and return an error to |
| avoid loading corrupted data from disk causing something bad. |
| |
| The Linux kernel CVE team has assigned CVE-2024-42304 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.19.62 with commit 3a17ca864baffc0c6f6e8aad525aa4365775a193 and fixed in 4.19.320 with commit d81d7e347d1f1f48a5634607d39eb90c161c8afe |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 5.4.282 with commit e02f9941e8c011aa3eafa799def6a134ce06bcfa |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 5.10.224 with commit de2a011a13a46468a6e8259db58b1b62071fe136 |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 5.15.165 with commit 9771e3d8365ae1dd5e8846a204cb9af14e3e656a |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 6.1.103 with commit b609753cbbd38f8c0affd4956c0af178348523ac |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 6.6.44 with commit c3893d9de8ee153baac56d127d844103488133b5 |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 6.10.3 with commit 299bc6ffa57e04e74c6cce866d6c0741fb4897a1 |
| Issue introduced in 5.3 with commit 4e19d6b65fb4fc42e352ce9883649e049da14743 and fixed in 6.11 with commit f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 |
| Issue introduced in 4.9.187 with commit 3f0307b0d2d8b333a6964fc4c820dc86896fd1cf |
| Issue introduced in 4.14.135 with commit 514631c2225c1fd556c799cc1893fb27b0f48f00 |
| Issue introduced in 5.1.21 with commit 7f1f86276515f6816a98f6ca3ef99c827d54642f |
| Issue introduced in 5.2.4 with commit 5021b7a5bdd6bb859eb648c3da71cdd6aae1d133 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42304 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/namei.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe |
| https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa |
| https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 |
| https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a |
| https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac |
| https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5 |
| https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1 |
| https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 |
