CVE-2018-10880

Published: 25 July 2018

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.

From the Ubuntu Security Team

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash).

Notes

possible reproducer in bug report
note that it depends on the ext4 inline_data feature, which
is not the default.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10880
• https://bugzilla.kernel.org/show_bug.cgi?id=200005
• https://ubuntu.com/security/notices/USN-3821-1
• https://ubuntu.com/security/notices/USN-3821-2
• https://ubuntu.com/security/notices/USN-3871-1
• https://ubuntu.com/security/notices/USN-3871-3
• https://ubuntu.com/security/notices/USN-3871-4
• https://ubuntu.com/security/notices/USN-3871-5
• NVD
• Launchpad
• Debian