CVE-2024-53685

ceph: give up on paths longer than PATH_MAX

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability. I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.

N/A

CVSS

Severity:

EPSS 0.09%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f
https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a
https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069
https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108
https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa
https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f

Frequently Asked Questions

What is the severity of CVE-2024-53685?: CVE-2024-53685 has not yet been assigned a CVSS score.
How to fix CVE-2024-53685?: To fix CVE-2024-53685, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-53685 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-53685 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-53685?: CVE-2024-53685 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.