VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions 1 Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2024/41xxx/CVE-2024-41034.json
T

359 lines
18 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-41034",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2024-07-12T12:17:45.619Z",
"datePublished": "2024-07-29T14:31:49.043Z",
"dateUpdated": "2026-08-05T11:34:51.748Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T11:34:51.748Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug on rename operation of broken directory\n\nSyzbot reported that in rename directory operation on broken directory on\nnilfs2, __block_write_begin_int() called to prepare block write may fail\nBUG_ON check for access exceeding the folio/page size.\n\nThis is because nilfs_dotdot(), which gets parent directory reference\nentry (\"..\") of the directory to be moved or renamed, does not check\nconsistency enough, and may return location exceeding folio/page size for\nbroken directories.\n\nFix this issue by checking required directory entries (\".\" and \"..\") in\nthe first chunk of the directory in nilfs_dotdot()."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through local filesystem operations (a rename syscall) on a mounted nilfs2 volume built from an attacker-crafted image; there is no network-facing path into nilfs2 directory handling.\nAC:L - The attacker fully controls the on-disk directory inode (i_size = 0 with a garbage first entry and an arbitrary 16-bit rec_len), making the out-of-bounds \"..\\\" pointer and the resulting BUG_ON/OOB write deterministic with no race or memory-layout condition outside attacker control.\nPR:N - The attacker needs no privileges or account on the target — they only supply the malicious nilfs2 image (disk image or removable media); the rename that triggers the bug is an ordinary unprivileged operation on the mounted filesystem.\nUI:R - Because nilfs2 lacks FS_USERNS_MOUNT and requires a block device, the crafted image must be mounted by a privileged user or an automount daemon acting on inserted media before the rename can be performed.\nS:U - The corruption and crash occur within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - nilfs_set_link() dereferences an out-of-bounds nilfs_dir_entry up to ~64 KB past the folio, reading rec_len from adjacent kernel memory, and the resulting heap corruption/prepared-chunk mismatch can be leveraged to disclose kernel memory.\nI:H - When the OOB-read rec_len keeps the BUG_ON check satisfied, `de->inode` and `de->file_type` are written 8+1 bytes at an attacker-chosen offset beyond the folio, giving a controlled out-of-bounds write into adjacent kernel memory that is exploitable for further corruption.\nA:H - The reported and readily reproducible outcome is BUG_ON(to > folio_size(folio)) in __block_write_begin_int(), a kernel oops/panic taken with the folio locked inside an active nilfs transaction, wedging the filesystem or crashing the machine."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"fs/nilfs2/dir.c"
],
"versions": [
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "ff9767ba2cb949701e45e6e4287f8af82986b703",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "24c1c8566a9b6be51f5347be2ea76e25fc82b11e",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "a9a466a69b85059b341239766a10efdd3ee68a4b",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "7000b438dda9d0f41a956fc9bffed92d2eb6be0d",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "1a8879c0771a68d70ee2e5e66eea34207e8c6231",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "60f61514374e4a0c3b65b08c6024dd7e26150bfd",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5",
"status": "affected",
"versionType": "git"
},
{
"version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
"lessThan": "a9e1ddc09ca55746079cc479aa3eb6411f0d99d4",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"fs/nilfs2/dir.c"
],
"versions": [
{
"version": "2.6.30",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.30",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "4.19.318",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.4.280",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.222",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.163",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.100",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.41",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.9.10",
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.10",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "4.19.318"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "5.4.280"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "5.10.222"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "5.15.163"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "6.1.100"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "6.6.41"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "6.9.10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.30",
"versionEndExcluding": "6.10"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703"
},
{
"url": "https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e"
},
{
"url": "https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b"
},
{
"url": "https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d"
},
{
"url": "https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231"
},
{
"url": "https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd"
},
{
"url": "https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5"
},
{
"url": "https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4"
}
],
"title": "nilfs2: fix kernel bug on rename operation of broken directory",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2025-11-03T21:59:30.758Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2024-41034",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-09-10T16:23:37.441886Z"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2024-09-11T17:32:58.811Z"
}
}
]
}
}
View Git Blame Copy Permalink