ext4: improve error handling from ext4_dirhash() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.17 % · centile 6 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that function can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and reflect the errors back up to their callers.
Références
- https://git.kernel.org/stable/c/b2531936118deb3f479c4fa1bcd787b74b8faa6a
- https://git.kernel.org/stable/c/f68876aeef96ef8b708ab10b9cb47ce0a5adb424
- https://git.kernel.org/stable/c/70d579aefa652a06af97e013e3fbbabbe5a43553
- https://git.kernel.org/stable/c/c1fae027da61fe8e7eb99f7244297e81bc0f1e43
- https://git.kernel.org/stable/c/4b3cb1d108bfc2aebb0d7c8a52261a53cf7f5786
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-32817
- GCVE · GCVE-0-2023-53473
Avis du CERT-FR
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.2 < 5.15.112cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.29cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.2.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.3 < 6.3.3cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected b886ee3e778ec2ad43e276fd378ab492cf6819b7 < b2531936118deb3f479c4fa1bcd787b74b8faa6a ; affected b886ee3e778ec2ad43e276fd378ab492cf6819b7 < f68876aeef96ef8b708ab10b9cb47ce0a5adb424 ; affected b886ee3e778ec2ad43e276fd378ab492cf6819b7 < 70d579aefa652a06af97e013e3fbbabbe5a43553 ; affected b886ee3e778ec2ad43e276fd378ab492cf6819b7 < c1fae027da61fe8e7eb99f7244297e81bc0f1e43 ; affected b886ee3e778ec2ad43e276fd378ab492cf6819b7 < 4b3cb1d108bfc2aebb0d7c8a52261a53cf7f5786 |
| Linux · Linux | affected 5.2 ; unaffected 0 < 5.2 ; unaffected 5.15.112 ≤ 5.15.* ; unaffected 6.1.29 ≤ 6.1.* ; unaffected 6.2.16 ≤ 6.2.* ; unaffected 6.3.3 ≤ 6.3.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |