CVE-2024-42305

CVE Details

Release Date:

2024-08-17

Description

In the Linux kernel, the following vulnerability has been resolved:\next4: check dot and dotdot of dx_root before making dir indexed\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n\nmake_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\next4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\next4_rename fs/ext4/namei.c:3936 [inline]\next4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\ndo_split\nunsigned split\ndx_make_map\ncount = 1\nsplit = count/2 = 0;\ncontinued = hash2 == map[split - 1].hash;\n---> map[4294967295]\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\nBut syzbot's crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\nbus dentry1 hole dentry2 free\n|xx--|xx-------------|...............|xx-------------|...............|\n0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That's why count is equal to 1.\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue.

See more information about CVE-2024-42305 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.1
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality:	High
Integrity:	None
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12780	2024-10-11
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12782	2024-10-14
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12868	2024-12-06
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12780	2024-10-11
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12782	2024-10-14
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12815	2024-11-11
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12815	2024-11-11