CVE-2024-42304: linux
Vulnerability summary
CVE-2024-42304 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 29 · Related 24Timeline
- 17-08-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu128 products
- linuxAll versions (No fix recorded) | < 5.4.0-200.220 | < 5.15.0-125.135 | < 6.8.0-50.51
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.4.0-1135.145 | < 5.15.0-1072.78 | < 6.8.0-1020.22
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 3a17ca864baffc0c6f6e8aad525aa4365775a193, < d81d7e347d1f1f48a5634607d39eb90c161c8afe | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < e02f9941e8c011aa3eafa799def6a134ce06bcfa | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < de2a011a13a46468a6e8259db58b1b62071fe136 | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < 9771e3d8365ae1dd5e8846a204cb9af14e3e656a | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < b609753cbbd38f8c0affd4956c0af178348523ac | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < c3893d9de8ee153baac56d127d844103488133b5 | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < 299bc6ffa57e04e74c6cce866d6c0741fb4897a1 | ≥ 4e19d6b65fb4fc42e352ce9883649e049da14743, < f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 | 3f0307b0d2d8b333a6964fc4c820dc86896fd1cf | 514631c2225c1fd556c799cc1893fb27b0f48f00 | 7f1f86276515f6816a98f6ca3ef99c827d54642f | 5021b7a5bdd6bb859eb648c3da71cdd6aae1d133 | ≥ 4.19.62, < 4.19.320 | ≥ 4.9.187, < 4.10 | ≥ 4.14.135, < 4.15 | ≥ 5.1.21, < 5.2 | ≥ 5.2.4, < 5.3 | 5.3
- linux_kernel≥ 4.9.187, < 4.10 | ≥ 4.14.135, < 4.15 | ≥ 4.19.62, < 4.19.320 | ≥ 5.1.21, < 5.2 | ≥ 5.2.4, < 5.4.282 | ≥ 5.5, < 5.10.224 | ≥ 5.11, < 5.15.165 | ≥ 5.16, < 6.1.103 | ≥ 6.2, < 6.6.44 | ≥ 6.7, < 6.10.3
Debian1 product
- linux< 6.1.106-1 | < 6.10.3-1
3 vendors · 131 products
