CVE-2015-8839: Race Condition
First published: Mon Apr 04 2016(Updated: )
A flaw was found in the Linux kernel when attempting to "punch a hole" in files existing on an ext4 filesystem. When punching holes into a file races with the page fault of the same area, it is possible that freed blocks remain referenced from page cache pages mapped to process' address space. Thus modification of these blocks can corrupt data someone else is now storing in those blocks when at some point those pages are written to disk. Upstream fixes: <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b">http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b</a> <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=17048e8a083fec7ad841d88ef0812707fbc7e39f">http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=17048e8a083fec7ad841d88ef0812707fbc7e39f</a> <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70">http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70</a> <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=011278485ecc3cd2a3954b5d4c73101d919bf1fa">http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=011278485ecc3cd2a3954b5d4c73101d919bf1fa</a> References: <a href="http://seclists.org/oss-sec/2016/q2/1">http://seclists.org/oss-sec/2016/q2/1</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel | <=4.4.221 | |
| Linux kernel | =4.5-rc1 | |
| Linux kernel | =4.5-rc2 | |
| Linux kernel | =4.5-rc3 | |
| Linux kernel | =4.5-rc4 | |
| Linux kernel | =4.5-rc5 | |
| Linux kernel | =4.5-rc6 | |
| Linux kernel | =4.5-rc7 | |
| Ubuntu Linux | =14.04 | |
| Ubuntu Linux | =16.04 | |
| Linux Kernel | <=4.4.221 | |
| Linux Kernel | =4.5-rc1 | |
| Linux Kernel | =4.5-rc2 | |
| Linux Kernel | =4.5-rc3 | |
| Linux Kernel | =4.5-rc4 | |
| Linux Kernel | =4.5-rc5 | |
| Linux Kernel | =4.5-rc6 | |
| Linux Kernel | =4.5-rc7 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.135-1 6.12.22-1 6.12.25-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
- http://www.openwall.com/lists/oss-security/2016/04/01/4
- http://www.securityfocus.com/bid/85798
- http://www.securitytracker.com/id/1035455
- http://www.ubuntu.com/usn/USN-3005-1
- http://www.ubuntu.com/usn/USN-3006-1
- http://www.ubuntu.com/usn/USN-3007-1
- https://access.redhat.com/errata/RHSA-2017:1842
- https://access.redhat.com/errata/RHSA-2017:2077
- https://access.redhat.com/errata/RHSA-2017:2669
- https://bugzilla.redhat.com/show_bug.cgi?id=1323577
- https://github.com/torvalds/linux/commit/ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
- https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
- https://launchpad.net/bugs/cve/CVE-2015-8839
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=17048e8a083fec7ad841d88ef0812707fbc7e39f
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=011278485ecc3cd2a3954b5d4c73101d919bf1fa
- http://seclists.org/oss-sec/2016/q2/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1323579
- https://git.kernel.org/linus/ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
- https://git.kernel.org/linus/17048e8a083fec7ad841d88ef0812707fbc7e39f
- https://git.kernel.org/linus/32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70
- https://git.kernel.org/linus/011278485ecc3cd2a3954b5d4c73101d919bf1fa
- https://bugzilla.suse.com/show_bug.cgi?id=972174
- https://security-tracker.debian.org/tracker/CVE-2015-8839
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8839
- https://nvd.nist.gov/vuln/detail/CVE-2015-8839
- https://ubuntu.com/security/CVE-2015-8839
Frequently Asked Questions
What is CVE-2015-8839?
CVE-2015-8839 is a vulnerability in the ext4 filesystem implementation in the Linux kernel before version 4.5 that allows local users to cause a denial of service (disk corruption).
How severe is CVE-2015-8839?
CVE-2015-8839 has a severity level of medium.
Which software is affected by CVE-2015-8839?
The affected software includes Linux kernel versions before 4.5.
How can I fix CVE-2015-8839?
To fix CVE-2015-8839, you should update your Linux kernel to version 4.5 or higher.
Where can I find more information about CVE-2015-8839?
You can find more information about CVE-2015-8839 on the following links: - [Link 1](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b) - [Link 2](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=17048e8a083fec7ad841d88ef0812707fbc7e39f) - [Link 3](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32ebffd3bbb4162da5ff88f9a35dd32d0a28ea70)
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-8839
- agent/severity
- agent/remedy
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/references
- collector/usn-cve
- source/Ubuntu
- agent/trending
- agent/source
- agent/author
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/4.4.221
- version/linux kernel/4.5-rc1
- version/linux kernel/4.5-rc2
- version/linux kernel/4.5-rc3
- version/linux kernel/4.5-rc4
- version/linux kernel/4.5-rc5
- version/linux kernel/4.5-rc6
- version/linux kernel/4.5-rc7
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/14.04
- version/ubuntu linux/16.04
- canonical/ubuntu
- version/ubuntu/14.04
- version/ubuntu/16.04
- package-manager/debian