VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42304

CVE-2024-42304

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: make sure the first directory block is not a hole

The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow.

ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported.

After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.

Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel ext4 bug allows crafted directory with hole in first block, causing crash due to missing '.' and '..' entries.

The vulnerability in ext4 allows a specially crafted directory where the first block is a hole, bypassing error checks in ext4_read_dirblock(). Normally, ext4_read_dirblock() expects a valid block for the first directory block, but when it encounters a hole, it does not report an error for DIRENT type entries, leading to a directory lacking '.' and '..' entries but containing valid dentries. [1]

Attackers can exploit this by constructing a malicious filesystem image or triggering the creation of such a directory. No special privileges are required to create files in such a directory, as the flaw lies in the kernel's handling of directory blocks. The bug was discovered via syzbot, indicating it can be triggered through fuzzing. [1]

The impact is a potential crash in code that relies on the presence of '.' and '..' directories, such as make_indexed_dir(). This could lead to denial of service. The vulnerability has a CVSS v3 base score of 5.5, indicating medium severity with local attack vector and high availability impact. [1]

The fix, already committed in stable kernel updates, ensures that when ext4_read_dirblock() finds the first directory block is a hole, it reports filesystem corruption and returns an error, preventing loading of corrupted data. Patches are available in the kernel stable tree. [2][3][4]

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

86

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.