{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42304", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.272Z", "datePublished": "2024-08-17T09:09:10.545Z", "dateUpdated": "2026-08-05T11:36:31.993Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:31.993Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: make sure the first directory block is not a hole\n\nThe syzbot constructs a directory that has no dirblock but is non-inline,\ni.e. the first directory block is a hole. And no errors are reported when\ncreating files in this directory in the following flow.\n\n ext4_mknod\n ...\n ext4_add_entry\n // Read block 0\n ext4_read_dirblock(dir, block, DIRENT)\n bh = ext4_bread(NULL, inode, block, 0)\n if (!bh && (type == INDEX || type == DIRENT_HTREE))\n // The first directory block is a hole\n // But type == DIRENT, so no error is reported.\n\nAfter that, we get a directory block without '.' and '..' but with a valid\ndentry. This may cause some code that relies on dot or dotdot (such as\nmake_indexed_dir()) to crash.\n\nTherefore when ext4_read_dirblock() finds that the first directory block\nis a hole report that the filesystem is corrupted and return an error to\navoid loading corrupted data from disk causing something bad." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires a locally mounted ext4 filesystem containing the crafted directory and is driven by ordinary local syscalls (creat/mknod/rename) against that directory. There is no network-facing path into `ext4_add_entry()` without a locally mounted corrupt image.\nAC:L - The attacker fully controls the on-disk image, so the block-0 hole and the resulting dot/dotdot-less directory are created deterministically; no race, timing window, or uncontrollable memory layout is involved. A single file creation followed by a rename reliably reaches `make_indexed_dir()`/`do_split()`.\nPR:L - Once the crafted or corrupted filesystem is mounted, any unprivileged local user with write access to the affected directory triggers the bug through normal file-creation and rename syscalls. No CAP_SYS_ADMIN or other capability is checked on this path.\nUI:N - No victim action is needed at exploit time — the corrupt filesystem may already be mounted (shared/automounted removable media via udisks2, or pre-existing on-disk corruption), and the trigger is the attacker's own syscalls. This matches CNA precedent for ext4 bugs triggered by operations on an already-mounted corrupt image.\nS:U - The out-of-bounds access and directory-metadata corruption occur entirely within the kernel's own security authority on the affected host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dot/dotdot-less directory causes `do_split()` to index `map[0xFFFFFFFF]`, an unbounded out-of-bounds read far outside the buffer whose result is folded into the persisted htree hash, and `ext4_htree_fill_tree()` copies attacker-chosen `name_len` bytes of adjacent block data out to userspace via getdents. This is arbitrary/unbounded kernel memory disclosure, not a few strictly bounded bytes.\nI:H - The kernel silently accepts and writes back corrupt directory metadata — allocating and populating block 0 without `.`/`..`, then running `dx_move_dirents()`/`dx_pack_dirents()` memcpy/memset operations and `dx_insert_block()` driven by a bogus entry map and out-of-bounds-derived hash. The resulting attacker-influenced kernel memory corruption and on-disk directory/htree corruption is exploitable for control-flow-relevant heap manipulation.\nA:H - The wild out-of-bounds read triggers an unrecoverable page fault / kernel oops (as captured by syzbot) while the task holds the directory `i_rwsem` and an open jbd2 transaction handle, hanging the filesystem for all other users. Any kernel oops or panic is High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ext4/namei.c" ], "versions": [ { "version": "3a17ca864baffc0c6f6e8aad525aa4365775a193", "lessThan": "d81d7e347d1f1f48a5634607d39eb90c161c8afe", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "e02f9941e8c011aa3eafa799def6a134ce06bcfa", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "de2a011a13a46468a6e8259db58b1b62071fe136", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "9771e3d8365ae1dd5e8846a204cb9af14e3e656a", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "b609753cbbd38f8c0affd4956c0af178348523ac", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "c3893d9de8ee153baac56d127d844103488133b5", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "299bc6ffa57e04e74c6cce866d6c0741fb4897a1", "status": "affected", "versionType": "git" }, { "version": "4e19d6b65fb4fc42e352ce9883649e049da14743", "lessThan": "f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6", "status": "affected", "versionType": "git" }, { "version": "3f0307b0d2d8b333a6964fc4c820dc86896fd1cf", "status": "affected", "versionType": "git" }, { "version": "514631c2225c1fd556c799cc1893fb27b0f48f00", "status": "affected", "versionType": "git" }, { "version": "7f1f86276515f6816a98f6ca3ef99c827d54642f", "status": "affected", "versionType": "git" }, { "version": "5021b7a5bdd6bb859eb648c3da71cdd6aae1d133", "status": "affected", "versionType": "git" }, { "version": "4.19.62", "lessThan": "4.19.320", "status": "affected", "versionType": "semver" }, { "version": "4.9.187", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.135", "lessThan": "4.15", "status": "affected", "versionType": "semver" }, { "version": "5.1.21", "lessThan": "5.2", "status": "affected", "versionType": "semver" }, { "version": "5.2.4", "lessThan": "5.3", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ext4/namei.c" ], "versions": [ { "version": "5.3", "status": "affected" }, { "version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.62", "versionEndExcluding": "4.19.320" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.4.282" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.187" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe" }, { "url": "https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa" }, { "url": "https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136" }, { "url": "https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a" }, { "url": "https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac" }, { "url": "https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5" }, { "url": "https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1" }, { "url": "https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6" } ], "title": "ext4: make sure the first directory block is not a hole", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42304", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:10:22.365835Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:28.095Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:04:09.091Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:56:50.352Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }