CVE-2017-7495: Infoleak
A flaw was found in the kernels implementation of ext4 for filesystems mounted with data=ordered mode. Stale data from recently allocated blocks may appear in newly created blocks in files when a system is 'power reset'. This may allow an attacker to gain information about file contents being written to disk when the system was being reset. This issue only affects regular write()'s and not when an application is using direct IO.
In testing, the amount of stale-data leakage is at maximum the amount of outstanding delayed journal transactions to the underlying device since the last commit (defaulting to 5 seconds, but tunable/exasperated with commit=nrsec mount option).
Other sources
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel ext4to a version that resolves this vulnerability.Fixed in 4.6.2 - Configuration
Avoid using ext4 with mount option data=ordered to prevent the stale-data leakage described for ext4 ordered mode.
ext4 filesystem mount data = ordered - Compensating control
If possible, prevent or reduce opportunities for hardware/power resets (e.g., ensure clean shutdowns or mitigate unexpected resets), since the stale data is observed after a 'power reset'.
Event History
Frequently Asked Questions
What is the vulnerability ID of this security vulnerability?
The vulnerability ID of this security vulnerability is CVE-2017-7495.
What is the severity of CVE-2017-7495?
The severity of CVE-2017-7495 is high.
What software is affected by CVE-2017-7495?
The Linux kernel versions before 4.6.2 with ext4 data=ordered mode are affected by CVE-2017-7495.
How can I fix CVE-2017-7495?
To fix CVE-2017-7495, update your Linux kernel version to 4.7 or higher.
Where can I find more information about CVE-2017-7495?
You can find more information about CVE-2017-7495 at the following references: [http://www.securityfocus.com/bid/98491](http://www.securityfocus.com/bid/98491), [https://bugzilla.redhat.com/show_bug.cgi?id=1450261](https://bugzilla.redhat.com/show_bug.cgi?id=1450261), [http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f47168841376824](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f47168841376824)