CVE-2024-40972
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedJul 12, 2024
First seenJul 12, 2024
How to fix
Update
- linux linux_kernel6.1.107, 6.6.47, 6.9.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 6.1.107, 6.2 ≤ v < 6.6.47, 6.7 ≤ v < 6.9.7 | 6.1.107, 6.6.47, 6.9.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.