CVE-2018-1094

Published: 01 April 2018

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.

From the Ubuntu security team

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly initialize the crc32c checksum driver. A local attacker could use this to cause a denial of service (system crash).

Priority

Medium

CVSS 3 base score: 5.5

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-24.26)
Patches:
Introduced by dec214d00e0d78a08b947d7dccdfdb84407a9f4d
Fixed by a45403b51582a87872927a3e0fc0a389c26867f1
linux-aws
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1011.11)
linux-aws-hwe
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-azure
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1014.14)
linux-azure-edge
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1014.14)
linux-euclid
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-flo
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-gcp
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1010.10)
linux-gcp-edge
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(4.18.0-1004.5~18.04.1)
linux-gke
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-goldfish
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-grouper
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-hwe
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(4.18.0-13.14~18.04.1)
linux-hwe-edge
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(4.18.0-12.13~18.04.1)
linux-kvm
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1012.12)
linux-lts-trusty
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-lts-utopic
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-lts-vivid
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-lts-wily
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-lts-xenial
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-maguro
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-mako
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-manta
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

linux-oem
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1009.12)
linux-oracle
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(4.15.0-1007.9)
linux-raspi2
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.15.0-1013.14)
linux-snapdragon
Launchpad, Ubuntu, Debian
Upstream
Released (4.17~rc1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable