DSA-4535: -1 e2fsprogs -- security update
Published Sep 27, 2019
·Updated
e2fsprogs - security update
Other sources
Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code.
Affected Software
2 affected components
debian/e2fsprogs
debian/e2fsprogs
Event History
Sep 27, 2019
Advisory Published
12:00 AM
Frequently Asked Questions
1
What must an attacker provide or influence to exploit this issue?
The attacker needs e2fsck to be run against a malformed ext2, ext3, or ext4 file system. The flaw is in quota-code handling within e2fsck.
2
Who is most likely exposed?
Systems or workflows that run e2fsck on file systems from untrusted or attacker-influenced sources are the most relevant exposure. This can include maintenance, recovery, or validation processes that inspect externally supplied file system images.
3
What is the impact if exploitation succeeds?
Running e2fsck on the malformed file system can result in arbitrary code execution.