High · published February 26, 2025
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid cycles in directory h-tree
A maliciously corrupted filesystem can contain cycles in the h-tree
stored inside a directory. That can easily lead to the kernel corrupting
tree nodes that were already verified under its hands while doing a node
split and consequently accessing unallocated memory. Fix the problem by
verifying traversed block numbers are unique.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.14.283 | 4.14.283 |
| linux/linux_kernel | ≥ 4.15, < 4.19.247 | 4.19.247 |
| linux/linux_kernel | ≥ 4.20, < 5.4.198 | 5.4.198 |
| linux/linux_kernel | ≥ 5.5, < 5.10.121 | 5.10.121 |
| linux/linux_kernel | ≥ 5.11, < 5.15.46 | 5.15.46 |
| linux/linux_kernel | ≥ 5.16, < 5.17.14 | 5.17.14 |
| linux/linux_kernel | ≥ 5.18, < 5.18.3 | 5.18.3 |