Infinite Directory Reads Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-46701: In the Linux kernel, the following vulnerability has been resolved: libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations from simple_dir_operations to simple_offset_dir_operations, ever... Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. This vulnerability affects versions of the Linux kernel in Debian 13 and 14, specifically related to the handling of directory operations in tmpfs, which can lead to infinite directory reads.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of directory reads when using tmpfs. The issue arises when the operations switch from simple_dir_operations to simple_offset_dir_operations, causing a rename operation to fill the destination directory's maple tree with free keys. This can lead to an infinite loop during directory reads when combined with simultaneous rename operations, potentially causing system instability and failure of specific tests (generic/736 in xfstests). The vulnerability is traced back to the logic used in managing directory offsets, which fails to properly track the last index of entries, allowing for repeated reads of the same entries.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The infinite directory reads vulnerability in the Linux kernel poses a significant risk to systems running affected versions. It is essential for users to update to the patched version 6.10.7-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time, providing an added layer of protection.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows for infinite directory reads in the Linux kernel when using tmpfs, which can lead to system instability.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.10.7-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to mitigate risks.
Failure to address this vulnerability may lead to system crashes, data loss, or other unexpected behaviors due to infinite directory reads.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
