CVE-2024-42304: ext4: make sure the first directory block is not a hole
In the Linux kernel, the following vulnerability has been resolved:
ext4: make sure the first directory block is not a hole
The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow.
ext4mknod ... ext4addentry // Read block 0 ext4readdirblock(dir, block, DIRENT) bh = ext4bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENTHTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported.
After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as makeindexeddir()) to crash.
Therefore when ext4readdirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42304?
CVE-2024-42304 is rated as a moderate severity vulnerability affecting the ext4 filesystem in the Linux kernel.
How do I fix CVE-2024-42304?
To fix CVE-2024-42304, update your Linux kernel to version 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1, or apply the recommended patches.
What versions of Linux are affected by CVE-2024-42304?
CVE-2024-42304 affects Linux kernel versions up to and including 5.10.223-1 and specific versions of 6.1.
Is CVE-2024-42304 publicly known?
Yes, CVE-2024-42304 is a publicly disclosed vulnerability that has been documented in security advisories.
What is the impact of CVE-2024-42304 on Linux systems?
The impact of CVE-2024-42304 could potentially lead to data integrity issues if exploited, as it involves an improper handling of directory blocks.