Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-39469

nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 2ac8a2fe22bdde9eecce2a42cf5cab79333fb428; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 405b71f1251e5ae865f53bd27c45114e6c83bee3; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in c77ad608df6c091fe64ecb91f41ef7cb465587f1; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 11a2edb70356a2202dcb7c9c189c8356ab4752cd; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 129dcd3e7d036218db3f59c82d82004b9539ed82; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in d18b05eda7fa77f02114f15b02c009f28ee42346; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 59f14875a96ef93f05b82ad3c980605f2cb444b5; From 2ba466d74ed74f073257f86e61519cb8f8f46184 · fixed in 7373a51e7998b508af7136530f3a997b286ce81c

  • Linux Linux

    2.6.30

  • KernelLinux

    From 2.6.30 · fixed in 4.19.317; From 4.20.0 · fixed in 5.4.279; From 5.5.0 · fixed in 5.10.221; From 5.11.0 · fixed in 5.15.162; From 5.16.0 · fixed in 6.1.95; From 6.2.0 · fixed in 6.6.35; From 6.7.0 · fixed in 6.9.5

References 8

git.kernel.org