CVE-2024-43828: linux Infinite Loop

Vulnerability summary

CVE-2024-43828 is a medium (CVSS 5.5) Infinite Loop vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities.

Timeline

1. 17-08-2024
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem!

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.