Issue metadata
Sign in to add a comment
|
CVE-2017-18249 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-18249 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-18249 CVSS severity score: 4.4/10.0 Description: The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Apr 19 2018
F2FS is not enabled in ChromeOS builds. Need to check COS/Lakitu.
,
Apr 19 2018
,
Apr 19 2018
Applying the patch to chromeos-4.4 causes substantial conflicts, which may be the reason why it wasn't applied to older kernels. We should only backport it to older kernels if it is enabled in any of our configurations; if so, it may make sense to apply context patches as well. If we do, we should send the backport(s) to stable@ and ask for it to be added to v4.4.y.
,
Apr 19 2018
Thanks, will mark as WontFix if it is not enabled in COS/Lakitu.
,
Apr 19 2018
,
Apr 19 2018
CONFIG_F2FS_FS is not enabled for COS and Lakitu images. Lets mark as WontFix. Also updated security impact.
,
Apr 19 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by zsm@chromium.org
, Apr 19 2018Labels: Security_Severity-Medium Security_Impact-Stable Pri-2
Owner: zsm@chromium.org
Status: Assigned (was: Untriaged)
The patch is 30a61ddf8117("f2fs: fix race condition in between free nid allocator/initializer"). It is present in 4.14. The patch is not present in 4.4, 3.18, 3.14, 3.10, 3.8.