Issue metadata
Sign in to add a comment
|
CVE-2018-1095 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2018-1095 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-1095 CVSS severity score: 7.1/10.0 Description: The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
May 3 2018
,
May 3 2018
,
May 3 2018
,
May 3 2018
Guenter points out that according to the kernel team's guidelines, these are SS-High. While we harmonize the guidelines, we can follow the kernel team's for kernel bugs.
,
May 3 2018
,
May 3 2018
Triaged at chromium:835889 as below:
CVE-2018-1095:
Upstream commit ce3fd194fc ("ext4: limit xattr size to INT_MAX"). No CVE severity assigned. 4.4 not affected. Queued for v4.14.36.
------------------------------------
3.18 and older versions do not seem to be affected.
,
May 4 2018
,
May 18 2018
zsm: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 18 2018
We are at v4.14.40, so we should be fine. Marking as duplicate of v4.14.36 merge bug.
,
Aug 24
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by jorgelo@chromium.org
, May 3 2018Status: Available (was: Untriaged)