CVE-2024-57940

What it actually does

Corrupted exfat cluster chain with self-referential cluster and unused directory entry prevents dentry increment in exfat_readdir, bypassing the max_dentries check and causing an infinite loop that holds s_lock and blocks other operations such as exfat_sync_fs.

Why it matters to the business

Systems using exfat filesystems can experience complete hangs affecting file operations and system stability, leading to operational downtime especially on embedded or storage devices where corruption may occur naturally or via malicious input.

How an attack unfolds

An attacker supplies or induces a specially corrupted exfat image containing a cluster that points to itself along with an unused directory entry; when a process calls readdir on the affected directory the kernel enters an infinite loop, starving other tasks that need the superblock lock.

How to fix it

Apply the kernel commit that stops cluster-chain traversal upon encountering an unused directory entry; for listed Red Hat packages upgrade libxml2 to the versions 0:2.7.6-21.el6_8.1 (EL6) or 0:2.9.1-6.el7_2.3 (EL7) and reboot if necessary.

How to confirm the fix worked

Verify the running kernel contains the fix by checking the exfat_readdir implementation or confirm package versions match the supplied fixed releases; test with a crafted self-referential exfat image to ensure readdir terminates.

Typical attack path

1. Craft or obtain an exfat filesystem image with a self-linked cluster
2. Insert an unused directory entry within that cluster
3. Mount the image and trigger directory enumeration
4. Observe indefinite hang due to unreleased s_lock

How to detect it

Inspect kernel logs for repeated exfat directory traversal messages or processes stuck in exfat_readdir; correlate with exfat filesystem mount events from untrusted images.

What your security team should do

• Prioritize patching systems that mount exfat volumes from untrusted sources
• Monitor for filesystem corruption indicators on exfat partitions
• Apply the exact fixed package versions provided for Red Hat Enterprise Linux 6 and 7