Linux Kernel EXT4 File System memory corruption

Summaryinfo

A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is an unknown functionality of the component EXT4 File System. Performing a manipulation results in memory corruption. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel (Operating System) (the affected version unknown). This affects an unknown part of the component EXT4 File System. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 10/31/2016 by Sergej Schumilo and Ralf Spenneberg as OS-S 2016-22 - Local DoS: Linux Kernel EXT4 Memory Corruption / SLAB-Out-of-Bounds Read as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. An attack has to be approached locally. A authentication is necessary for exploitation. Technical details are unknown but a public exploit is available. The advisory points out:

Mounting a crafted EXT4 image read-only leads to a memory corruption and SLAB-Out-of-Bounds Reads (according to KASAN). Since the mounting procedure is a privileged operation, an attacker is probably not able to trigger this vulnerability on the commandline. Instead the automatic mounting feature of the GUI via a crafted USB-device is required.

A public exploit has been developed by Sergej Schumilo/Ralf Spenneberg in EXT4 Image and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 181 days. During that time the estimated underground price was around $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Further details are available at bugzilla.redhat.com. Entry connected to this vulnerability is available at VDB-93622. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion