CVE-2024-41034

nilfs2: fix kernel bug on rename operation of broken directory

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories. Fix this issue by checking required directory entries ("." and "..") in the first chunk of the directory in nilfs_dotdot().

N/A

CVSS

Severity:

EPSS 0.27%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703
https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e
https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b
https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d
https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231
https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd
https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5
https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4

Frequently Asked Questions

What is the severity of CVE-2024-41034?: CVE-2024-41034 has not yet been assigned a CVSS score.
How to fix CVE-2024-41034?: To fix CVE-2024-41034, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-41034 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-41034 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-41034?: CVE-2024-41034 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.