CVE-2024-53685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53685
In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability. I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f Patch
https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f Patch
https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa Patch
https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108 Patch
https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a Patch
https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
History

15 Oct 2025, 20:46

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-835
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f - () https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f - Patch
References () https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f - () https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f - Patch
References () https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa - () https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa - Patch
References () https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108 - () https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108 - Patch
References () https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a - () https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a - Patch
References () https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069 - () https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069 - Patch

02 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f -

23 Jan 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a -

17 Jan 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: renunciar a rutas más largas que PATH_MAX Si la ruta completa que se va a construir con ceph_mdsc_build_path() resulta ser más larga que PATH_MAX, esta función entrará en un bucle sin fin (de reintento), bloqueando efectivamente toda la tarea. La mayor parte de la máquina queda inutilizable, lo que hace que esta sea una vulnerabilidad de denegación de servicio (DoS) muy simple y efectiva. No puedo imaginar por qué se implementó este reintento, pero me parece bastante inútil y dañino. Eliminémoslo y fallemos con ENAMETOOLONG en su lugar.
References
  • () https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069 -

11 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-11 13:15

Updated : 2025-10-15 20:46

NVD link : CVE-2024-53685

Mitre link : CVE-2024-53685

CVE.ORG link : CVE-2024-53685

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')