ext4: Fix Use-After-Free in ext4_rename_dir_prepare
Summary
GSD-2022-1003500: ext4: fix use-after-free in ext4_rename_dir_prepare. Affects Kernel versions < dd887f83ea54aea5b780a84527e23ab95f777fed. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 filesystem is a widely used filesystem in the Linux kernel. It provides support for large file systems and files, journaling, and other advanced features. The ext4_rename_dir_prepare function is responsible for preparing a directory for renaming in the ext4 filesystem. However, a use-after-free vulnerability has been discovered in this function, which could lead to a security issue.
Vulnerability Detail
The use-after-free vulnerability in ext4_rename_dir_prepare occurs when a directory is being renamed in the ext4 filesystem. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability originates from a failure to properly handle reference counting of directory entries during the renaming process. By manipulating the filesystem in a specific way, an attacker could trigger the use-after-free condition and potentially gain unauthorized access or disrupt the system's normal operation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch or update the Linux kernel to the fixed version as soon as possible.
Conclusion
The use-after-free vulnerability in ext4_rename_dir_prepare poses a significant security risk to systems running the affected versions of the Linux kernel. It is crucial to update the kernel to version v5.10.121 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use-after-free condition in ext4_rename_dir_prepare.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to apply the fix or update the Linux kernel to mitigate the risk.
No, this vulnerability is fixed in Linux Kernel version v5.10.121 and later. It is recommended to update to the fixed version to ensure the security of your system.
For more details about this vulnerability, including the commit that fixes it, you can refer to the source link provided in the vulnerability details section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
