Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

["Theodore Ts'o" <tytso@mit.edu>]

On Mon, Dec 09, 2024 at 02:08:02PM +0100, gregkh@linuxfoundation.org wrote:
> On Mon, Dec 09, 2024 at 12:30:08PM +0000, Siddh Raman Pant wrote:
> > On Mon, 21 Oct 2024 20:02:55 +0200, Greg Kroah-Hartman wrote:
> > > In the Linux kernel, the following vulnerability has been resolved:
> > > 
> > > ext4: no need to continue when the number of entries is 1
> > > 
> > > The Linux kernel CVE team has assigned CVE-2024-49967 to this issue.
> > 
> > This seems to fix nothing:
> > 
> > https://lore.kernel.org/all/6ba9afc8-fa95-478c-8ed2-a4ad10b3c520@huawei.com/
> 
> Ok, so should it be revoked?

We're not aware of a way of triggering the OOB error, so in that sense
the CVE is not valid.  There might be a way that someone might be able
to trigger it in the future; in that hypothetical future, there might
be some other fix that would address the root cause, but this would be
a belt and suspenders thing that might prevent that (hypothetical)
future.  So in that sense, it is highly commended that enterprise
distros and people who are not following the LTS kernels take this
patch.  But is it actually fixing a known vulnerability today?  Not
that we know of.

Cheers,

						- Ted

P.S.  If some security researcher wants to find such a way, to educate
people on why using LTS kernels is superior, they should feel free to
consider this a challenge.  :-P