Executive brief
A vulnerability in the Linux kernel's ext4 file system could allow a local user to cause a system hang or denial of service. When the system attempts to recover the file system using the 'fast_commit' feature, a software error can trigger an infinite loop. This prevents the system from completing the recovery process and may render the affected storage volume inaccessible.
Technical details
A vulnerability exists in the ext4 file system component of the Linux kernel where an uninitialized 'extent_status' structure can lead to an infinite loop. During a fast_commit replay, the function 'ext4_ext_determine_insert_hole()' calls 'ext4_es_find_extent_range()'. Because the latter returns immediately during replay without initializing the 'es' variable, the structure contains garbage data. This garbage data can trigger an integer overflow in subsequent logic, resulting in an infinite loop (CWE-835). The issue is fixed by ensuring the structure is unconditionally initialized. The vulnerability is reachable by local users and impacts system availability.
Affected products
- Linux Linux Kernel 5.10 to 5.10.223, 5.11 to 5.15.164, 5.16 to 6.1.102, 6.2 to 6.6.43, 6.7 to 6.10.2
Timeline
- 2024-08-17: disclosed
- 2024-08-17: advisory
- 2024-08-19: patched
References
- https://git.kernel.org/stable/c/0619f7750f2b178a1309808832ab20d85e0ad121
- https://git.kernel.org/stable/c/181e63cd595c688194e07332f9944b3a63193de2
- https://git.kernel.org/stable/c/5ed0496e383cb6de120e56991385dce70bbb87c1
- https://git.kernel.org/stable/c/81f819c537d29932e4b9267f02411cbc8b355178
- https://git.kernel.org/stable/c/907c3fe532253a6ef4eb9c4d67efb71fab58c706
- https://git.kernel.org/stable/c/c6e67df64783e99a657ef2b8c834ba2bf54c539c
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html