摘要:
In the Linux kernel, the following vulnerability has been resolved:libfs: fix infinite directory reads for offset dirAfter we switch tmpfs dir operations from simple_dir_operations tosimple_offset_dir_operations, every rename happened will fill new dentryto dest dir s maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a freekey starting with octx->newx_offset, and then set newx_offset equals tofree key + 1. This will lead to infinite readdir combine with renamehappened at the same time, which fail generic/736 in xfstests(detail showas below).1. create 5000 files(1 2 3...) under one dir2. call readdir(man 3 readdir) once, and get one entry3. rename(entry, TEMPFILE ), then rename( TEMPFILE , entry)4. loop 2~3, until readdir return nothing or we loop too many times(tmpfs break test with the second condition)We choose the same logic what commit 9b378f6ad48cf ( btrfs: fix infinitedirectory reads ) to fix it, record the last_index when we open dir, anddo not emit the entry which index >= last_index. The file->private_datanow used in offset dir can use directly to do this, and we also updatethe last_index when we llseek the dir file.[brauner: only update last_index after seek when offset is zero like Jan suggested]
安全等级: Low
公告ID: KylinSec-SA-2024-3898
发布日期: 2024年10月12日
关联CVE: CVE-2024-46701
In the Linux kernel, the following vulnerability has been resolved:libfs: fix infinite directory reads for offset dirAfter we switch tmpfs dir operations from simple_dir_operations tosimple_offset_dir_operations, every rename happened will fill new dentryto dest dir s maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a freekey starting with octx->newx_offset, and then set newx_offset equals tofree key + 1. This will lead to infinite readdir combine with renamehappened at the same time, which fail generic/736 in xfstests(detail showas below).1. create 5000 files(1 2 3...) under one dir2. call readdir(man 3 readdir) once, and get one entry3. rename(entry, TEMPFILE ), then rename( TEMPFILE , entry)4. loop 2~3, until readdir return nothing or we loop too many times(tmpfs break test with the second condition)We choose the same logic what commit 9b378f6ad48cf ( btrfs: fix infinitedirectory reads ) to fix it, record the last_index when we open dir, anddo not emit the entry which index >= last_index. The file->private_datanow used in offset dir can use directly to do this, and we also updatethe last_index when we llseek the dir file.[brauner: only update last_index after seek when offset is zero like Jan suggested]
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|
