VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-14615
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-14615
CVSS severity score: 7.1/10.0
Description:
An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be negative.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@chromium.org
, Sep 24Labels: Security_Severity-High Security_Impact-None Pri-1
Owner: zsm@chromium.org
Status: WontFix (was: Untriaged)
Upstream commit is 18dd6470c2("f2fs: fix to do sanity check with i_extra_isize") CONFIG_F2FS_FS is not set, so marking as WontFix. Will keep track of this bug in case the config flips in the future. Using configmonitor cronjob to monitor changes in kernel configs.