Riskcovery

CVE-2024-53685

ceph: give up on paths longer than PATH_MAX

State
Published
Severity
Not scored
Published
Jan 11, 2025
Updated
May 11, 2026
Reserved
Jan 11, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: give up on paths longer than PATH_MAX

If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability.

I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before 0f2b2d9e881c90402dbe28f9ba831775b7992e1fAffected
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before d42ad3f161a5a487f81915c406f46943c7187a0aAffected
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before e4b168c64da06954be5d520f6c16469b1cadc069Affected
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before c47ed91156daf328601d02b58d52d9804da54108Affected
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before 99a37ab76a315c8307eb5b0dc095d8ad9d8efeaaAffected
  • 9030aaf9bf0a1eee47a154c316c789e959638b0f to before 550f7ca98ee028a606aa75705a7e77b1bd11720fAffected
LinuxLinux
  • 2.6.34Affected
  • before 2.6.34Not affected
  • 5.10.234 through 5.10.*Not affected
  • 5.15.177 through 5.15.*Not affected
  • 6.1.125 through 6.1.*Not affected
  • 6.6.70 through 6.6.*Not affected
  • 6.12.7 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.