CVE-2024-42305 is a vulnerability identified in the Linux kernel's ext4 filesystem implementation, specifically within the directory indexing (dx) feature. The flaw arises during the handling of directory entries (dentries) in the ext4 filesystem when converting a directory to an indexed format. The vulnerability is triggered by an abnormal condition where the directory lacks the mandatory '.' (dot) and '..' (dotdot) entries, which are normally the first two entries in any directory. This abnormal state was discovered through Syzbot fuzzing, which generated a crafted filesystem image missing these entries. The kernel code assumes the presence of these entries and uses them to manage the directory index root (dx_root). When these entries are missing, the function make_indexed_dir() incorrectly processes the directory entries, leading to a count of only one valid dentry during the splitting operation in do_split(). This causes an out-of-bounds access when the code attempts to access map[split - 1], where split is zero, resulting in a page fault and kernel oops (crash). The root cause is that the code does not validate the dot and dotdot entries before proceeding with the directory indexing conversion, leading to unsafe memory access. The patch involves adding a helper function ext4_check_dx_root() to perform sanity checks on these entries before conversion, preventing the out-of-bounds access. This vulnerability affects Linux kernel versions around 6.10.0-rc5 and potentially others using the ext4 filesystem with directory indexing enabled. Exploitation requires crafted filesystem images or manipulation of directory entries, which could be triggered locally or via malicious mounts. No known exploits are reported in the wild yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux with ext4 filesystems, which is common in servers, desktops, and embedded devices. The impact includes potential denial of service (DoS) through kernel crashes caused by out-of-bounds memory access, leading to system instability or downtime. In environments where Linux servers handle critical workloads or sensitive data, such crashes could disrupt services and impact business continuity. Although the vulnerability does not directly indicate privilege escalation or remote code execution, kernel crashes can be leveraged by attackers to cause persistent denial of service or potentially aid in further exploitation chains. Organizations relying on Linux-based infrastructure, including cloud providers, web hosting, and enterprise servers, may be affected if they mount or interact with maliciously crafted ext4 filesystems. The absence of known exploits suggests limited immediate threat, but the complexity of the vulnerability and its kernel-level nature warrant prompt attention to avoid future exploitation. Additionally, embedded devices and IoT systems using ext4 may be vulnerable, potentially impacting industrial or critical infrastructure sectors in Europe.

1. Apply the official Linux kernel patches that include the ext4_check_dx_root() helper function to validate directory entries before indexing conversion. Ensure all Linux systems are updated to kernel versions that contain this fix. 2. For systems unable to update immediately, avoid mounting untrusted or suspicious ext4 filesystems, especially those received from external or unknown sources. 3. Implement strict filesystem integrity checks and monitoring to detect anomalies in directory structures, particularly missing dot and dotdot entries. 4. Use kernel hardening features such as Kernel Address Sanitizer (KASAN) and Kernel Page Table Isolation (KPTI) to reduce the risk and impact of memory corruption vulnerabilities. 5. Employ containerization or sandboxing to limit the impact of potential kernel crashes on critical services. 6. Maintain regular backups and disaster recovery plans to mitigate downtime caused by unexpected kernel panics. 7. Monitor security advisories and vulnerability databases for updates or emerging exploits related to CVE-2024-42305.