Issue metadata
Sign in to add a comment
|
CVE-2018-10876 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2018-10876 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-10876 CVSS severity score: 4.9/10.0 Description: A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Sep 24
,
Sep 24
Marking this bug as WontFix as the changes in ext4 are substantial, and patches are not present in upstream stable, and do not apply cleanly. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by zsm@chromium.org
, Sep 24Labels: Security_Severity-Medium Security_Impact-Stable Pri-2
Owner: zsm@chromium.org
Status: Assigned (was: Untriaged)
Upstream commit is 8844618d8a("ext4: only look at the bg_flags field if it is valid") This commit is present in v4.14, v4.4. Older kernels do not have this commit. 3.18.y does not have this commit. A backport would require making calls to ensure that the superblock is valid before using ext4_group_desc fields. Also, there is a related upstream commit f547aa20b4f("ext4: fix check to prevent initializing reserved inodes")