CVE-2014-7283: Medium severity linux kernel vulnerability
A flaw was found in the way the xfsda3fixhashpath() function of the Linux kernel's XFS file system implementation ordered directory hashes under certain conditions. A local attacker could use this flaw to corrupt the file system by creating directories, potentially resulting in kernel panic.
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c88547a8119e3b581318ab65e9b72f27f23e641d
Reproducer:
http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs/cmds/xfstests.git;a=blob;f=src/dirhashcollide.c;h=55cec872d5061ac2ca0f56d1f11e6bf349d5bb97;hb=947ee8bd4b59770534297572b14c695e9c6e001e
References:
http://seclists.org/oss-sec/2014/q4/28 http://marc.info/?l=linux-xfs&m=139590613002926&w=2
Other sources
The xfsda3fixhashpath function in fs/xfs/xfsdabtree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7283?
CVE-2014-7283 is classified as a moderate severity vulnerability.
How do I fix CVE-2014-7283?
To fix CVE-2014-7283, you should update your Linux kernel to versions 3.14.2 or higher or apply relevant patches.
What are the potential impacts of CVE-2014-7283?
The potential impacts of CVE-2014-7283 include file system corruption that could lead to a kernel panic.
Which systems are affected by CVE-2014-7283?
CVE-2014-7283 affects the Linux kernel versions prior to 3.14.2 and specific versions of Red Hat MRG Realtime.
Who can exploit CVE-2014-7283?
A local attacker with sufficient permissions can exploit CVE-2014-7283 to create directories that corrupt the file system.