linux-kernel - Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241209162623.GA1667758@mit.edu>
Date: Mon, 9 Dec 2024 11:26:23 -0500
From: "Theodore Ts'o" <tytso@....edu>
To: "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
Cc: Siddh Raman Pant <siddh.raman.pant@...cle.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: CVE-2024-49967: ext4: no need to continue when the number of
 entries is 1

On Mon, Dec 09, 2024 at 02:08:02PM +0100, gregkh@...uxfoundation.org wrote:
> On Mon, Dec 09, 2024 at 12:30:08PM +0000, Siddh Raman Pant wrote:
> > On Mon, 21 Oct 2024 20:02:55 +0200, Greg Kroah-Hartman wrote:
> > > In the Linux kernel, the following vulnerability has been resolved:
> > > 
> > > ext4: no need to continue when the number of entries is 1
> > > 
> > > The Linux kernel CVE team has assigned CVE-2024-49967 to this issue.
> > 
> > This seems to fix nothing:
> > 
> > https://lore.kernel.org/all/6ba9afc8-fa95-478c-8ed2-a4ad10b3c520@huawei.com/
> 
> Ok, so should it be revoked?

We're not aware of a way of triggering the OOB error, so in that sense
the CVE is not valid.  There might be a way that someone might be able
to trigger it in the future; in that hypothetical future, there might
be some other fix that would address the root cause, but this would be
a belt and suspenders thing that might prevent that (hypothetical)
future.  So in that sense, it is highly commended that enterprise
distros and people who are not following the LTS kernels take this
patch.  But is it actually fixing a known vulnerability today?  Not
that we know of.

Cheers,

						- Ted

P.S.  If some security researcher wants to find such a way, to educate
people on why using LTS kernels is superior, they should feel free to
consider this a challenge.  :-P