CVE-2024-57940

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57940
In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/28c21f0ac5293a4bf19b3e0e32005d6dd31a6c17
https://git.kernel.org/stable/c/31beabd0f47f8c3ed9965ba861c9e5b252d4920a Patch
https://git.kernel.org/stable/c/d8cfbb8723bd3d3222f360227a1cc15227189ca6
https://git.kernel.org/stable/c/d9ea94f5cd117d56e573696d0045ab3044185a15 Patch
https://git.kernel.org/stable/c/dc1d7afceb982e8f666e70a582e6b5aa806de063 Patch
https://git.kernel.org/stable/c/fee873761bd978d077d8c55334b4966ac4cb7b59 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
History

02 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/d8cfbb8723bd3d3222f360227a1cc15227189ca6 -

23 Jan 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/28c21f0ac5293a4bf19b3e0e32005d6dd31a6c17 -

22 Jan 2025, 23:02

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: exfat: se corrige el bucle infinito en exfat_readdir() Si el sistema de archivos está dañado de modo que un clúster está vinculado a sí mismo en la cadena de clústeres y hay una entrada de directorio sin usar en el clúster, 'dentry' no se incrementará, lo que provocará que la condición 'dentry &lt; max_dentries' no pueda evitar un bucle infinito. Este bucle infinito hace que s_lock no se libere y otras tareas se cuelguen, como exfat_sync_fs(). Esta confirmación deja de recorrer la cadena de clústeres cuando hay una entrada de directorio sin usar en el clúster para evitar este bucle infinito.
First Time Linux linux Kernel
Linux
CWE CWE-835
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/31beabd0f47f8c3ed9965ba861c9e5b252d4920a - () https://git.kernel.org/stable/c/31beabd0f47f8c3ed9965ba861c9e5b252d4920a - Patch
References () https://git.kernel.org/stable/c/d9ea94f5cd117d56e573696d0045ab3044185a15 - () https://git.kernel.org/stable/c/d9ea94f5cd117d56e573696d0045ab3044185a15 - Patch
References () https://git.kernel.org/stable/c/dc1d7afceb982e8f666e70a582e6b5aa806de063 - () https://git.kernel.org/stable/c/dc1d7afceb982e8f666e70a582e6b5aa806de063 - Patch
References () https://git.kernel.org/stable/c/fee873761bd978d077d8c55334b4966ac4cb7b59 - () https://git.kernel.org/stable/c/fee873761bd978d077d8c55334b4966ac4cb7b59 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*

21 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 13:15

Updated : 2025-02-02 11:15

NVD link : CVE-2024-57940

Mitre link : CVE-2024-57940

CVE.ORG link : CVE-2024-57940

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')