{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-41034", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.619Z", "datePublished": "2024-07-29T14:31:49.043Z", "dateUpdated": "2026-08-05T11:34:51.748Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:51.748Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug on rename operation of broken directory\n\nSyzbot reported that in rename directory operation on broken directory on\nnilfs2, __block_write_begin_int() called to prepare block write may fail\nBUG_ON check for access exceeding the folio/page size.\n\nThis is because nilfs_dotdot(), which gets parent directory reference\nentry (\"..\") of the directory to be moved or renamed, does not check\nconsistency enough, and may return location exceeding folio/page size for\nbroken directories.\n\nFix this issue by checking required directory entries (\".\" and \"..\") in\nthe first chunk of the directory in nilfs_dotdot()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through local filesystem operations (a rename syscall) on a mounted nilfs2 volume built from an attacker-crafted image; there is no network-facing path into nilfs2 directory handling.\nAC:L - The attacker fully controls the on-disk directory inode (i_size = 0 with a garbage first entry and an arbitrary 16-bit rec_len), making the out-of-bounds \"..\\\" pointer and the resulting BUG_ON/OOB write deterministic with no race or memory-layout condition outside attacker control.\nPR:N - The attacker needs no privileges or account on the target — they only supply the malicious nilfs2 image (disk image or removable media); the rename that triggers the bug is an ordinary unprivileged operation on the mounted filesystem.\nUI:R - Because nilfs2 lacks FS_USERNS_MOUNT and requires a block device, the crafted image must be mounted by a privileged user or an automount daemon acting on inserted media before the rename can be performed.\nS:U - The corruption and crash occur within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - nilfs_set_link() dereferences an out-of-bounds nilfs_dir_entry up to ~64 KB past the folio, reading rec_len from adjacent kernel memory, and the resulting heap corruption/prepared-chunk mismatch can be leveraged to disclose kernel memory.\nI:H - When the OOB-read rec_len keeps the BUG_ON check satisfied, `de->inode` and `de->file_type` are written 8+1 bytes at an attacker-chosen offset beyond the folio, giving a controlled out-of-bounds write into adjacent kernel memory that is exploitable for further corruption.\nA:H - The reported and readily reproducible outcome is BUG_ON(to > folio_size(folio)) in __block_write_begin_int(), a kernel oops/panic taken with the folio locked inside an active nilfs transaction, wedging the filesystem or crashing the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/dir.c" ], "versions": [ { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "ff9767ba2cb949701e45e6e4287f8af82986b703", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "24c1c8566a9b6be51f5347be2ea76e25fc82b11e", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "a9a466a69b85059b341239766a10efdd3ee68a4b", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "7000b438dda9d0f41a956fc9bffed92d2eb6be0d", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "1a8879c0771a68d70ee2e5e66eea34207e8c6231", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "60f61514374e4a0c3b65b08c6024dd7e26150bfd", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5", "status": "affected", "versionType": "git" }, { "version": "2ba466d74ed74f073257f86e61519cb8f8f46184", "lessThan": "a9e1ddc09ca55746079cc479aa3eb6411f0d99d4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/dir.c" ], "versions": [ { "version": "2.6.30", "status": "affected" }, { "version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.318" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.280" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.100" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.41" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.9.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703" }, { "url": "https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e" }, { "url": "https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b" }, { "url": "https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d" }, { "url": "https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231" }, { "url": "https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd" }, { "url": "https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5" }, { "url": "https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4" } ], "title": "nilfs2: fix kernel bug on rename operation of broken directory", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/ff9767ba2cb949701e45e6e4287f8af82986b703", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a9a466a69b85059b341239766a10efdd3ee68a4b", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a9e1ddc09ca55746079cc479aa3eb6411f0d99d4", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:30.758Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-41034", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:23:37.441886Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:58.811Z" } } ] } }