CVE-2024-53234

erofs: handle NONHEAD !delta[1] lclusters gracefully

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: handle NONHEAD !delta[1] lclusters gracefully syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too.

N/A

CVSS

Severity:

EPSS 0.06%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/75a0a6dde803e7a3af700da8da9a361b49f69eba
https://git.kernel.org/stable/c/f466641debcbea8bdf78d1b63a6270aadf9301bf
https://git.kernel.org/stable/c/480c6c7b55aeacac800bc2a0d321ff53273045e5
https://git.kernel.org/stable/c/daaf68fef4b2ff97928227630021d37b27a96655
https://git.kernel.org/stable/c/0bc8061ffc733a0a246b8689b2d32a3e9204f43c

Frequently Asked Questions

What is the severity of CVE-2024-53234?: CVE-2024-53234 has not yet been assigned a CVSS score.
How to fix CVE-2024-53234?: To fix CVE-2024-53234, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-53234 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-53234 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-53234?: CVE-2024-53234 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.