High · published July 29, 2024
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel bug on rename operation of broken directory
Syzbot reported that in rename directory operation on broken directory on
nilfs2, __block_write_begin_int() called to prepare block write may fail
BUG_ON check for access exceeding the folio/page size.
This is because nilfs_dotdot(), which gets parent directory reference
entry ("..") of the directory to be moved or renamed, does not check
consistency enough, and may return location exceeding folio/page size for
broken directories.
Fix this issue by checking required directory entries ("." and "..") in
the first chunk of the directory in nilfs_dotdot().
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.30, < 4.19.318 | 4.19.318 |
| linux/linux_kernel | ≥ 4.20, < 5.4.280 | 5.4.280 |
| linux/linux_kernel | ≥ 5.5, < 5.10.222 | 5.10.222 |
| linux/linux_kernel | ≥ 5.11, < 5.15.163 | 5.15.163 |
| linux/linux_kernel | ≥ 5.16, < 6.1.100 | 6.1.100 |
| linux/linux_kernel | ≥ 6.2, < 6.6.41 | 6.6.41 |
| linux/linux_kernel | ≥ 6.7, < 6.9.10 | 6.9.10 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |