CVE-2024-53685
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
ceph: give up on paths longer than PATH_MAX
If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability.
I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.23%
- Percentil entre todas las CVEs puntuadas: 13
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-835
Referencias
- https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f
- https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f
- https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa
- https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108
- https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a
- https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-53685",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "0f2b2d9e881c90402dbe28f9ba831775b7992e1f",
"versionType": "git"
},
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "d42ad3f161a5a487f81915c406f46943c7187a0a",
"versionType": "git"
},
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "e4b168c64da06954be5d520f6c16469b1cadc069",
"versionType": "git"
},
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "c47ed91156daf328601d02b58d52d9804da54108",
"versionType": "git"
},
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa",
"versionType": "git"
},
{
"status": "affected",
"version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
"lessThan": "550f7ca98ee028a606aa75705a7e77b1bd11720f",
"versionType": "git"
}
],
"programFiles": [
"fs/ceph/mds_client.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.34",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.234",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.177",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.125",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.70",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.7",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ceph/mds_client.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-01-11T13:15:25.997",
"references": [
{
"url": "https://git.kernel.org/stable/c/0f2b2d9e881c90402dbe28f9ba831775b7992e1f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/550f7ca98ee028a606aa75705a7e77b1bd11720f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/99a37ab76a315c8307eb5b0dc095d8ad9d8efeaa",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d42ad3f161a5a487f81915c406f46943c7187a0a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e4b168c64da06954be5d520f6c16469b1cadc069",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-835"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: give up on paths longer than PATH_MAX\n\nIf the full path to be built by ceph_mdsc_build_path() happens to be\nlonger than PATH_MAX, then this function will enter an endless (retry)\nloop, effectively blocking the whole task. Most of the machine\nbecomes unusable, making this a very simple and effective DoS\nvulnerability.\n\nI cannot imagine why this retry was ever implemented, but it seems\nrather useless and harmful to me. Let's remove it and fail with\nENAMETOOLONG instead."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: renunciar a rutas más largas que PATH_MAX Si la ruta completa que se va a construir con ceph_mdsc_build_path() resulta ser más larga que PATH_MAX, esta función entrará en un bucle sin fin (de reintento), bloqueando efectivamente toda la tarea. La mayor parte de la máquina queda inutilizable, lo que hace que esta sea una vulnerabilidad de denegación de servicio (DoS) muy simple y efectiva. No puedo imaginar por qué se implementó este reintento, pero me parece bastante inútil y dañino. Eliminémoslo y fallemos con ENAMETOOLONG en su lugar."
}
],
"lastModified": "2026-06-17T08:09:06.013",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77DDE3F0-D7D6-4908-8930-621414EB9684",
"versionEndExcluding": "5.10.234",
"versionStartIncluding": "2.6.35"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "71A3AFDC-A3CA-454F-8917-E998BBDE36F8",
"versionEndExcluding": "5.15.177",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9AFD566B-ECC6-46F1-92F7-12A615D5685F",
"versionEndExcluding": "6.1.125",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51E6CFF2-92AA-4936-95AB-2D068168A696",
"versionEndExcluding": "6.6.70",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "811AC89A-14AC-49FA-9B54-E99526F1CA47",
"versionEndExcluding": "6.12.7",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3B1BC1D-ED46-4364-A1D9-1FA74182B03A"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7927713B-5EB0-41EB-86A9-9935775162E0"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59037296-3143-4FBB-AFF7-D4FE2C85502F"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CA27FD5-7DBF-4C85-80A9-D523B2E4B033"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9711E333-A8E7-4F4B-BCFD-2023E889651A"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E04D3358-973B-42A1-8E08-2E3AE947193C"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}