Vulnerability in ext4: fix bug_on in __es_tree_search
Summary
GSD-2022-1003555: ext4: fix bug_on in __es_tree_search. Affects Kernel versions >= 5946d089379a35dda0e531710b48fca05446a196, < 4fd58b5cf118d2d9038a0b8c9cc0e43096297686. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 package is a file system driver for the Linux Kernel. It provides support for the fourth extended file system (ext4) and is widely used in Linux distributions. The package is responsible for managing file storage and metadata on disk. However, a vulnerability has been discovered in the __es_tree_search function of ext4, which could potentially lead to security issues.
Vulnerability Detail
The vulnerability in ext4's __es_tree_search function was introduced in version v3.13 of the Linux Kernel and was fixed in version v5.10.121. The vulnerability could allow an attacker to trigger a bug_on condition, leading to a denial-of-service (DoS) situation. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to update to the fixed version to mitigate any potential risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to the fixed version of the Linux Kernel.
Conclusion
The vulnerability in ext4's __es_tree_search function could potentially lead to a denial-of-service (DoS) situation. It is recommended to update the Linux Kernel to version v5.10.121 or later to mitigate any potential risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ext4 is a file system driver for the Linux Kernel, providing support for the fourth extended file system (ext4). It manages file storage and metadata on disk.
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service (DoS) situation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
Yes, a fix is available in version v5.10.121 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
You can find more information about this vulnerability in the GSD-2022-1003555 entry of the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003555.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
