CVE - CVE-2024-40972

CVE-ID
CVE-2024-40972	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd URL:https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd MISC:https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b URL:https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b MISC:https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 URL:https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 MISC:https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 URL:https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1
Assigning CNA
kernel.org
Date Record Created
20240712	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240712)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)