Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[Siddh Raman Pant]

[-- Attachment #1: Type: text/plain, Size: 403 bytes --]

On Mon, 21 Oct 2024 20:02:55 +0200, Greg Kroah-Hartman wrote:
> In the Linux kernel, the following vulnerability has been resolved:
> 
> ext4: no need to continue when the number of entries is 1
> 
> The Linux kernel CVE team has assigned CVE-2024-49967 to this issue.

This seems to fix nothing:

https://lore.kernel.org/all/6ba9afc8-fa95-478c-8ed2-a4ad10b3c520@huawei.com/

Thanks,
Siddh

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[gregkh]

On Mon, Dec 09, 2024 at 12:30:08PM +0000, Siddh Raman Pant wrote:
> On Mon, 21 Oct 2024 20:02:55 +0200, Greg Kroah-Hartman wrote:
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > ext4: no need to continue when the number of entries is 1
> > 
> > The Linux kernel CVE team has assigned CVE-2024-49967 to this issue.
> 
> This seems to fix nothing:
> 
> https://lore.kernel.org/all/6ba9afc8-fa95-478c-8ed2-a4ad10b3c520@huawei.com/

Ok, so should it be revoked?

thanks,

greg k-h

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[Theodore Ts'o]

On Mon, Dec 09, 2024 at 02:08:02PM +0100, gregkh@linuxfoundation.org wrote:
> On Mon, Dec 09, 2024 at 12:30:08PM +0000, Siddh Raman Pant wrote:
> > On Mon, 21 Oct 2024 20:02:55 +0200, Greg Kroah-Hartman wrote:
> > > In the Linux kernel, the following vulnerability has been resolved:
> > > 
> > > ext4: no need to continue when the number of entries is 1
> > > 
> > > The Linux kernel CVE team has assigned CVE-2024-49967 to this issue.
> > 
> > This seems to fix nothing:
> > 
> > https://lore.kernel.org/all/6ba9afc8-fa95-478c-8ed2-a4ad10b3c520@huawei.com/
> 
> Ok, so should it be revoked?

We're not aware of a way of triggering the OOB error, so in that sense
the CVE is not valid.  There might be a way that someone might be able
to trigger it in the future; in that hypothetical future, there might
be some other fix that would address the root cause, but this would be
a belt and suspenders thing that might prevent that (hypothetical)
future.  So in that sense, it is highly commended that enterprise
distros and people who are not following the LTS kernels take this
patch.  But is it actually fixing a known vulnerability today?  Not
that we know of.

Cheers,

						- Ted

P.S.  If some security researcher wants to find such a way, to educate
people on why using LTS kernels is superior, they should feel free to
consider this a challenge.  :-P

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[Siddh Raman Pant]

[-- Attachment #1: Type: text/plain, Size: 1088 bytes --]

On Mon, Dec 09 2024 at 21:56:23 +0530, Theodore Ts'o wrote:
> On Mon, Dec 09, 2024 at 02:08:02PM +0100, gregkh@linuxfoundation.org wrote:
> > Ok, so should it be revoked?

Yes, as this was an incorrect attempt at fixing CVE-2024-42305.

> We're not aware of a way of triggering the OOB error, so in that sense
> the CVE is not valid.  There might be a way that someone might be able
> to trigger it in the future; in that hypothetical future, there might
> be some other fix that would address the root cause, but this would be
> a belt and suspenders thing that might prevent that (hypothetical)
> future.  So in that sense, it is highly commended that enterprise
> distros and people who are not following the LTS kernels take this
> patch.  But is it actually fixing a known vulnerability today?  Not
> that we know of.
> 
> Cheers,
> 
> 						- Ted
> 
> P.S.  If some security researcher wants to find such a way, to educate
> people on why using LTS kernels is superior, they should feel free to
> consider this a challenge.  :-P

I agree.

Thanks,
Siddh

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[Theodore Ts'o]

It looks like this CVE hasn't been revoked yet, at least per
nvd.nist.gov?  Is that the best way to check kernel CVE's status?

Thanks,
					- Ted
					

On Tue, Dec 10, 2024 at 06:08:46AM +0000, Siddh Raman Pant wrote:
> On Mon, Dec 09 2024 at 21:56:23 +0530, Theodore Ts'o wrote:
> > On Mon, Dec 09, 2024 at 02:08:02PM +0100, gregkh@linuxfoundation.org wrote:
> > > Ok, so should it be revoked?
> 
> Yes, as this was an incorrect attempt at fixing CVE-2024-42305.
> 
> > We're not aware of a way of triggering the OOB error, so in that sense
> > the CVE is not valid.  There might be a way that someone might be able
> > to trigger it in the future; in that hypothetical future, there might
> > be some other fix that would address the root cause, but this would be
> > a belt and suspenders thing that might prevent that (hypothetical)
> > future.  So in that sense, it is highly commended that enterprise
> > distros and people who are not following the LTS kernels take this
> > patch.  But is it actually fixing a known vulnerability today?  Not
> > that we know of.
> > 
> > Cheers,
> > 
> > 						- Ted
> > 
> > P.S.  If some security researcher wants to find such a way, to educate
> > people on why using LTS kernels is superior, they should feel free to
> > consider this a challenge.  :-P
> 
> I agree.
> 
> Thanks,
> Siddh

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[gregkh]

On Mon, Jan 06, 2025 at 01:09:16PM -0500, Theodore Ts'o wrote:
> It looks like this CVE hasn't been revoked yet, at least per
> nvd.nist.gov?  Is that the best way to check kernel CVE's status?

Yes it is, but I don't recall a concrete "please revoke this CVE"
request which is why it didn't happen.  Do you really want it revoked?

thanks,

greg k-h

Re: CVE-2024-49967: ext4: no need to continue when the number of entries is 1

[gregkh]

On Mon, Jan 06, 2025 at 07:14:18PM +0100, gregkh@linuxfoundation.org wrote:
> On Mon, Jan 06, 2025 at 01:09:16PM -0500, Theodore Ts'o wrote:
> > It looks like this CVE hasn't been revoked yet, at least per
> > nvd.nist.gov?  Is that the best way to check kernel CVE's status?
> 
> Yes it is, but I don't recall a concrete "please revoke this CVE"
> request which is why it didn't happen.  Do you really want it revoked?

Ok, now revoked.

thanks

greg k-h