CVE-2012-4508: Race Condition
A race condition flaw has been found in the way asynchronous I/O and fallocate interacted which can lead to exposure of stale data -- that is, an extent which should have had the "uninitialized" bit set indicating that its blocks have not yet been written and thus contain data from a deleted file. An unprivileged local user could use this flaw to cause an information leak.
Acknowledgements:
Red Hat would like to thank Theodore Ts'o for reporting this issue. Upstream acknowledges Dmitry Monakhov as the original reporter.
References:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=dee1f973ca341c266229faa5a1a5bb268bed3531
Other sources
Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.4.16
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4508?
CVE-2012-4508 is classified as a medium severity vulnerability due to its potential to expose stale data.
How do I fix CVE-2012-4508?
To fix CVE-2012-4508, update to a Linux kernel version 5.10.223-1 or newer, or 6.1.123-1 or newer.
What are the affected versions for CVE-2012-4508?
CVE-2012-4508 affects Linux kernel versions up to 3.4.15 and specific release candidate versions of 3.0 and 3.1.
What type of vulnerability is CVE-2012-4508?
CVE-2012-4508 is a race condition vulnerability involving asynchronous I/O and fallocate operations.
Can CVE-2012-4508 lead to data exposure?
Yes, CVE-2012-4508 can lead to exposure of stale data from deleted files.