CVE-2011-4086: Buffer Overflow
journalunmapbuffer()'s zapbuffer: code clears a lot of buffer head state ala discardbuffer(), but does not touch Delay or Unwritten as discardbuffer() does.
This can be problematic in some areas of the ext4 code which assume that if they have found a buffer marked unwritten or delay, then it's a live one. They do not check whether a buffer is mapped, so jbd2's partial teardown can be problematic if they assume that this buffer head is still valid.
(Mounting without a journal also avoids the bug, because with no journal we go to unmapbuffer(), which does the right thing).
An unprivileged local user could use this flaw to crash the system.
Other sources
The journalunmapbuffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the Delay and Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4086?
CVE-2011-4086 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2011-4086?
To fix CVE-2011-4086, update the Linux kernel to version 3.3.1 or later.
What systems are affected by CVE-2011-4086?
CVE-2011-4086 affects various versions of the Linux kernel, up to and including 3.3.
What is the impact of CVE-2011-4086?
The impact of CVE-2011-4086 includes potential data corruption in specific scenarios related to buffer management.
When was CVE-2011-4086 disclosed?
CVE-2011-4086 was disclosed in 2011 as part of a batch of vulnerabilities affecting the Linux kernel.