CVE-2013-2015: Medium severity Linux Linux kernel vulnerability
Linux kernel built with an Ext4 file system is vulnerable to a system hang situation when [auto]mounting a non-journal filesystem with an orphan list to clear.
A user could use this flaw to stall the system resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/0e9a9a1ad619e7e987815d20262d36a2f95717ca
Other sources
The ext4orphandel function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/forphanextentsinode/image.gz test.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2015?
CVE-2013-2015 has a severity rating that indicates a denial of service risk due to system hang situations when mounting affected file systems.
How do I fix CVE-2013-2015?
To mitigate CVE-2013-2015, ensure you update your Linux Kernel to version 3.7.2 or higher where the vulnerability is patched.
What systems are affected by CVE-2013-2015?
CVE-2013-2015 affects Linux kernel versions up to and including 3.7.2 across specific distributions.
What are the implications of CVE-2013-2015?
Exploiting CVE-2013-2015 can lead to a denial of service condition, causing the system to hang when handling specific file systems.
When was CVE-2013-2015 reported?
CVE-2013-2015 was publicly disclosed in April 2013, highlighting its existence and the potential impacts on affected systems.