CVE-2024-46701

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libfs: fix infinite directory reads for offset dir

After we switch tmpfs dir operations from simple_dir_operations to

simple_offset_dir_operations, every rename happened will fill new dentry

to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free

key starting with octx->newx_offset, and then set newx_offset equals to

free key + 1. This will lead to infinite readdir combine with rename

happened at the same time, which fail generic/736 in xfstests(detail show

as below).

1. create 5000 files(1 2 3...) under one dir

2. call readdir(man 3 readdir) once, and get one entry

3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry)

4. loop 2~3, until readdir return nothing or we loop too many

times(tmpfs break test with the second condition)

We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite

directory reads") to fix it, record the last_index when we open dir, and

do not emit the en

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References