CVE-2024-46701

libfs: fix infinite directory reads for offset dir

published September 13, 2024

CVSS
—
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

libfs: fix infinite directory reads for offset dir

After we switch tmpfs dir operations from simple_dir_operations to

simple_offset_dir_operations, every rename happened will fill new dentry

to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free

key starting with octx->newx_offset, and then set newx_offset equals to

free key + 1. This will lead to infinite readdir combine with rename

happened at the same time, which fail generic/736 in xfstests(detail show

as below).

1. create 5000 files(1 2 3...) under one dir

2. call readdir(man 3 readdir) once, and get one entry

3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry)

4. loop 2~3, until readdir return nothing or we loop too many

times(tmpfs break test with the second condition)

We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite

directory reads") to fix it, record the last_index when we open dir, and

do not emit the entry which index >= last_index. The file->private_data

now used in offset dir can use directly to do this, and we also update

the last_index when we llseek the dir file.

[brauner: only update last_index after seek when offset is zero like Jan suggested]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Published
2024-09-13T06:27Z
EPSS history
Timeline
  • 13 SEP 06:27Z
    libfs: fix infinite directory reads for offset dir
    cvelistv5