CVE-2024-39469

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system.

In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot.

Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page.

A flaw of low impact was found in the Linux kernel's nilfs2 file system code. When a directory folio/page read fails inside nilfs_empty_dir(), the error is mishandled: the function falsely judges the directory as empty, which can corrupt the file system, and because it does not immediately return after a failed read but keeps looping, it can enter a long loop performing I/O when the directory inode's i_size is also corrupted, causing the nilfs2 log writer thread to wait and hang. Triggering this issue requires local access to a system with a nilfs2 file system that is experiencing read errors or corrupted metadata. Red Hat assessed this flaw as Low impact with a CVSSv3 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting availability impact only, while NIST and the CVE.org record scored it 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) by additionally counting integrity impact; the difference reflects the more limited practical consequences Red Hat attributes to the misjudged empty-directory condition. All current Red Hat product entries for this flaw are marked not affected, including every maintained Red Hat Enterprise Linux kernel and kernel-rt stream, the hosted OpenShift offerings, and Fedora: the vulnerable nilfs2 code is not built into the Red Hat Enterprise Linux kernels, so the affected code path is not present in shipped Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.