CVE-2018-10879: Use After Free
A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200001
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=513f86d73855ce556ea9522b6bfd79f87356dc3a
Other sources
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10879?
CVE-2018-10879 has a high severity as it can lead to a denial of service or other unspecified impacts.
How do I fix CVE-2018-10879?
To fix CVE-2018-10879, update your Linux kernel to the patched versions specified for your distribution.
Which systems are affected by CVE-2018-10879?
CVE-2018-10879 affects various Linux distributions including specific versions of Debian, Ubuntu, and Red Hat Enterprise Linux.
What attack vector does CVE-2018-10879 exploit?
CVE-2018-10879 can be exploited by a local user through a crafted ext4 filesystem image when renaming files.
What is the impact of CVE-2018-10879 on systems?
The impact of CVE-2018-10879 includes potential denial of service and may allow for other unspecified effects.