CVE-2024-53685
ceph: give up on paths longer than PATH_MAX
Summary
ceph: give up on paths longer than PATH_MAX
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
ceph: give up on paths longer than PATH_MAX
If the full path to be built by ceph_mdsc_build_path() happens to be
longer than PATH_MAX, then this function will enter an endless (retry)
loop, effectively blocking the whole task. Most of the machine
becomes unusable, making this a very simple and effective DoS
vulnerability.
I cannot imagine why this retry was ever implemented, but it seems
rather useless and harmful to me. Let's remove it and fail with
ENAMETOOLONG instead.
Affected packages
Linux
Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.34"},{"fixed":"5.10.234"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.177"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.125"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.70"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.7"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2024-53685 linux-lts Fixed in: 6.1.127-r0
- Debian DEBIAN-CVE-2024-53685 linux Fixed in: 5.10.234-1
- Ubuntu UBUNTU-CVE-2024-53685 linux
References
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web lists.debian.org
- web lists.debian.org