Linux Kernel EXT4 Error denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This affects an unknown part of the component EXT4 Error Handler. The manipulation leads to denial of service. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Linux Kernel (Operating System) (affected version unknown) and classified as problematic. This issue affects an unknown functionality of the component EXT4 Error Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was disclosed 10/31/2016 by Ralf Spenneberg as OS-S 2016-23 - Local DoS: Linux Kernel EXT4 Error Handling (EXT4 calling panic()) as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. The exploitation is known to be easy. Attacking locally is a requirement. The successful exploitation needs a simple authentication. Technical details are unknown but a public exploit is available. The advisory points out:

Mounting a crafted EXT4 image as read-only leads to a kernel panic. Since the mounting procedure is a privileged operation, an attacker is probably not able to trigger this vulnerability on the commandline. Instead the automatic mounting feature of the GUI via a crafted USB-device is required.

A public exploit has been developed by Ralf Spenneberg in EXT4 Image and been published immediately after the advisory. The exploit is available at os-s.net. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 181 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion