CVE-2018-10881: Buffer Overflow
A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4getgroupinfo function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image.
References:
https://bugzilla.kernel.org/showbug.cgi?id=200015
http://patchwork.ozlabs.org/patch/929792/
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e8ab72a812396996035a37e5ca4b3b99b5d214b
Other sources
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4getgroupinfo function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch https://bugzilla.kernel.org/show_bug.cgi?id=200015 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e8ab72a812396996035a37e5ca4b3b99b5d214b - Compensating control
Mitigate CVE-like local DoS/crash risk by preventing untrusted local users from mounting and operating ext4 images (e.g., restrict mount permissions to trusted users/groups via system configuration/OS hardening) until the upstream ext4 fix is applied.
Event History
Frequently Asked Questions
What is CVE-2018-10881?
CVE-2018-10881 is a vulnerability in the Linux kernel's ext4 filesystem that can be exploited by a local user to cause a denial of service and system crash.
How can this vulnerability be exploited?
This vulnerability can be exploited by mounting and operating on a crafted ext4 filesystem image.
What is the severity of CVE-2018-10881?
CVE-2018-10881 has a low severity rating.
How do I fix CVE-2018-10881?
To fix CVE-2018-10881, update the affected Linux kernel packages to the specified versions.
Where can I find more information about CVE-2018-10881?
You can find more information about CVE-2018-10881 in the provided references.