CVE-2024-53685
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability. I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedJan 11, 2025
First seenJan 11, 2025
Weakness typeCWE-835CWE-835
How to fix
Update
- linux linux_kernel5.10.234, 5.15.177, 6.1.125, 6.6.70, 6.12.7 or later
Patches
- git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f
- git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f
- git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa
- git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108
- git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a
- git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.35 ≤ v < 5.10.234, 5.11 ≤ v < 5.15.177, 5.16 ≤ v < 6.1.125, 6.2 ≤ v < 6.6.70, 6.7 ≤ v < 6.12.7, 2.6.34, 6.13 | 5.10.234, 5.15.177, 6.1.125, 6.6.70, 6.12.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.