CVE-2024-40972

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40972
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd Patch
https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b Patch
https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 Patch
https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 Patch
https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b Patch
https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Feb 2025, 15:43

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-667
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd - () https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd - Patch
References () https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b - () https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b - Patch
References () https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 - () https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 - Patch
References () https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 - () https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 - Patch

21 Nov 2024, 09:31

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b - () https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b -
References () https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 - () https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 -

29 Aug 2024, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd -

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: no crear inodo EA bajo bloqueo de búfer ext4_xattr_set_entry() crea nuevos inodos EA mientras mantiene el bloqueo de búfer en el bloque xattr externo. Esto es problemático ya que anida todo el bloqueo de asignación (que adquiere bloqueos en otros búfer) bajo el bloqueo del búfer. Esto puede incluso bloquearse cuando el sistema de archivos está dañado y, por ejemplo, el archivo de cuota está configurado para contener el bloque xattr como bloque de datos. Mueva la asignación del inodo EA de ext4_xattr_set_entry() a las personas que llaman.

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2025-02-03 15:43

NVD link : CVE-2024-40972

Mitre link : CVE-2024-40972

CVE.ORG link : CVE-2024-40972

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking