CVE-2024-46701

published 2024-09-13

CVE-2024-46701: In the Linux kernel, the following vulnerability has been resolved: libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

libfs: fix infinite directory reads for offset dir

After we switch tmpfs dir operations from simple_dir_operations to
simple_offset_dir_operations, every rename happened will fill new dentry
to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free
key starting with octx->newx_offset, and then set newx_offset equals to
free key + 1. This will lead to infinite readdir combine with rename
happened at the same time, which fail generic/736 in xfstests(detail show
as below).

1. create 5000 files(1 2 3...) under one dir
2. call readdir(man 3 readdir) once, and get one entry
3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry)
4. loop 2~3, until readdir return nothing or we loop too many
times(tmpfs break test with the second condition)

We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite
directory reads") to fix it, record the last_index when we open dir, and
do not emit the entry which index >= last_index. The file->private_data
now used in offset dir can use directly to do this, and we also update
the last_index when we llseek the dir file.

[brauner: only update last_index after seek when offset is zero like Jan suggested]

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.10.7-1 (forky)	linux 6.10.7-1 (forky)
linux	linux	—	—
linux	linux	>= a2e459555c5f9da3e619b7e47a63f98574dc75f1 < 308b4fc2403b335894592ee9dc212a5e58bb309f	308b4fc2403b335894592ee9dc212a5e58bb309f
linux	linux	>= a2e459555c5f9da3e619b7e47a63f98574dc75f1 < 64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a	64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.10.7-1	6.10.7-1
linux	linux_kernel	>= 0 < 6.10.7-1	6.10.7-1
linux	linux_kernel	>= 0 < 6.8.0-50.51	6.8.0-50.51
linux	linux_kernel	>= 6.6 < 6.10.7	6.10.7

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 9.8 CRITICAL

vendor_debian 5.5 LOW

vendor_redhat 5.5 MEDIUM

vendor_ubuntu 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-835