CVE-2018-10880: Medium severity Debian Debian Linux vulnerability
A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4updateinlinedata() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200005
http://patchwork.ozlabs.org/patch/930639/
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8cdb5240ec5928b20490a2bb34cb87e9a5f40226
Other sources
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4updateinlinedata(). An attacker could use this to cause a system crash and a denial of service.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10880?
CVE-2018-10880 has a severity rating that indicates it can cause a system crash and denial of service.
How do I fix CVE-2018-10880?
To fix CVE-2018-10880, users should update their Linux kernel to version 5.10.223-1 or later.
Which systems are affected by CVE-2018-10880?
CVE-2018-10880 affects Debian Linux 8.0, Red Hat Enterprise Linux 7.0, and various versions of Ubuntu Linux.
What causes the vulnerability in CVE-2018-10880?
The vulnerability in CVE-2018-10880 is caused by a stack-out-of-bounds write in the ext4_update_inline_data() function.
Can CVE-2018-10880 be exploited remotely?
Yes, an attacker can exploit CVE-2018-10880 remotely by mounting and writing to a crafted ext4 image.