CVE-2024-46701 libfs: fix infinite directory reads for offset dir
A flaw in the Linux kernel's tmpfs implementation allows attackers to cause an infinite loop during directory reads, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46701?
CVE-2024-46701 is a medium-severity denial of service vulnerability in Linux kernel, published on 13 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
libfs: fix infinite directory reads for offset dir
After we switch tmpfs dir operations from simple_dir_operations to simple_offset_dir_operations, every rename happened will fill new dentry to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free key starting with octx->newx_offset, and then set newx_offset equals to free key + 1. This will lead to infinite readdir combine with rename happened at the same time, which fail generic/736 in xfstests(detail show as below).
1. create 5000 files(1 2 3...) under one dir 2. call readdir(man 3 readdir) once, and get one entry 3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry) 4. loop 2~3, until readdir return nothing or we loop too many times(tmpfs break test with the second condition)
We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite directory reads") to fix it, record the last_index when we open dir, and do not emit the entry which index >= last_index. The file->private_data now used in offset dir can use directly to do this, and we also update the last_index when we llseek the dir file.
[brauner: only update last_index after seek when offset is zero like Jan suggested]
Weakness: CWE-835
Which versions are affected by CVE-2024-46701?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46701?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-46701 being exploited?
There is no known exploitation of CVE-2024-46701 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49318, BELL-CVE-2024-46701, DEBIAN-CVE-2024-46701, GHSA-q844-wpfg-w2h9, UBUNTU-CVE-2024-46701.