CVE-2018-13099

Published: 3 July 2018

An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.

From the Ubuntu Security Team

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash).

Notes

possible reproducer in kernel bugzilla
fix subject "f2fs: fix to do sanity check with reserved
blkaddr of inline inode"

The affected user base for this issue is likely small since f2fs is
not the default filesystem and it is not widely used in Ubuntu

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13099
• https://bugzilla.kernel.org/show_bug.cgi?id=200179
• https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=f2fs-dev&id=cc60e90f9bfab8d6a7fb826937e824333c3bf94a
• https://sourceforge.net/p/linux-f2fs/mailman/message/36356878/
• https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&id=4dbe38dc386910c668c75ae616b99b823b59f3eb
• https://ubuntu.com/security/notices/USN-3932-1
• https://ubuntu.com/security/notices/USN-3932-2
• https://ubuntu.com/security/notices/USN-4094-1
• https://ubuntu.com/security/notices/USN-4118-1
• NVD
• Launchpad
• Debian