CVE-2018-10876

Published: 26 July 2018

A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.

From the Ubuntu security team

Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code.

Priority

Low

CVSS 3 base score: 5.5

Status

Notes

fs/ext4/balloc.c
first issue in bugzilla report may require additional fix
possible reproducer in bug report

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10876
• https://bugzilla.kernel.org/show_bug.cgi?id=199403
• http://patchwork.ozlabs.org/patch/929239/
• https://ubuntu.com/security/notices/USN-3753-1
• https://ubuntu.com/security/notices/USN-3753-2
• https://ubuntu.com/security/notices/USN-3871-1
• https://ubuntu.com/security/notices/USN-3871-3
• https://ubuntu.com/security/notices/USN-3871-4
• https://ubuntu.com/security/notices/USN-3871-5
• NVD
• Launchpad
• Debian

Bugs