CVE-2014-8086

Published: 13 October 2014

Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.

From the Ubuntu security team

Dmitry Monakhov discovered a race condition in the ext4_file_write_iter function of the Linux kernel's ext4 filesystem. A local user could exploit this flaw to cause a denial of service (file unavailability).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

looks like the end if the discussion above on the ext4 list points to
changes proposed in https://lkml.org/lkml/2014/10/18/63, unsure if they
are sufficient either.
this was applied with a different subject line

Priority

Medium

CVSS 3 base score: 4.7

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8086
• http://www.spinics.net/lists/linux-ext4/msg45683.html
• https://ubuntu.com/security/notices/USN-2447-1
• https://ubuntu.com/security/notices/USN-2448-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1383361