CVE-2021-3428

Published: 15 March 2021

A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.

From the Ubuntu security team

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash).

Priority

Low

CVSS 3 base score: 5.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3428
• https://www.openwall.com/lists/oss-security/2021/03/17/1
• https://www.openwall.com/lists/oss-security/2021/03/17/5
• https://www.openwall.com/lists/oss-security/2021/03/17/13
• https://ubuntu.com/security/notices/USN-4979-1
• https://ubuntu.com/security/notices/USN-5137-1
• https://ubuntu.com/security/notices/USN-5137-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=1173485
• https://bugzilla.redhat.com/show_bug.cgi?id=1936786