CVE-2024-47660CWE-362

CVE-2024-47660

Medium · published October 9, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: clear PARENT_WATCHED flags lazily

In some setups directories can have many (usually negative) dentries.

Hence __fsnotify_update_child_dentry_flags() function can take a

significant amount of time. Since the bulk of this function happens

under inode->i_lock this causes a significant contention on the lock

when we remove the watch from the directory as the

__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()

races with __fsnotify_update_child_dentry_flags() calls from

__fsnotify_parent() happening on children. This can lead upto softlockup

reports reported by users.

Fix the problem by calling fsnotify_update_children_dentry_flags() to

set PARENT_WATCHED flags only when parent starts watching children.

When parent stops watching children, clear false positive PARENT_WATCHED

flags lazily in __fsnotify_parent() for each accessed child.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00160 · 4.7th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-10-09T18:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel< 5.10.2265.10.226
linux/linux_kernel≥ 5.11, < 5.15.1675.15.167
linux/linux_kernel≥ 5.16, < 6.1.1096.1.109
linux/linux_kernel≥ 6.2, < 6.6.506.6.50
linux/linux_kernel≥ 6.7, < 6.10.96.10.9
References (9)
EPSS history
Timeline
  • 09 OCT 14:02Z
    fsnotify: clear PARENT_WATCHED flags lazily
    cvelistv5