lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024072922-CVE-2024-41034-7593@gregkh> Date: Mon, 29 Jul 2024 16:32:29 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-41034: nilfs2: fix kernel bug on rename operation of broken directory Description =========== In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories. Fix this issue by checking required directory entries ("." and "..") in the first chunk of the directory in nilfs_dotdot(). The Linux kernel CVE team has assigned CVE-2024-41034 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 4.19.318 with commit ff9767ba2cb9 Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 5.4.280 with commit 24c1c8566a9b Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 5.10.222 with commit a9a466a69b85 Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 5.15.163 with commit 7000b438dda9 Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 6.1.100 with commit 1a8879c0771a Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 6.6.41 with commit 60f61514374e Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 6.9.10 with commit 298cd810d7fb Issue introduced in 2.6.30 with commit 2ba466d74ed7 and fixed in 6.10 with commit a9e1ddc09ca5 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-41034 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nilfs2/dir.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703 https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231 https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5 https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4
Powered by blists - more mailing lists