ext4: Filter Out EXT4_FC_REPLAY from on-disk Superblock Field s_state
Summary
GSD-2022-1003239: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state. Affects Kernel versions < b99fd73418350dea360da8311e87a6a7b0e15a4c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 package is a file system driver for the Linux Kernel. It provides support for the fourth extended file system (ext4) and is widely used in Linux distributions. The ext4 file system is known for its performance, scalability, and reliability. However, a vulnerability has been discovered in the package that affects the on-disk superblock field s_state.
Vulnerability Detail
The vulnerability in the ext4 package involves the failure to filter out the EXT4_FC_REPLAY flag from the on-disk superblock field s_state. This flag is used to indicate whether the file system is undergoing a fast commit replay. By not properly filtering this flag, an attacker could potentially manipulate the file system state and cause unexpected behavior or even a denial of service. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The ext4 package in the Linux Kernel is vulnerable to a flaw that allows the EXT4_FC_REPLAY flag to be present in the on-disk superblock field s_state. This vulnerability has been fixed in the Linux Kernel version v5.15.46. Users are advised to update their Linux Kernel to this version or a later one to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ext4 package is a file system driver for the Linux Kernel, providing support for the ext4 file system.
The impact of this vulnerability is currently unknown, as the attack plausibility has not been proven. However, it could potentially lead to unexpected behavior or a denial of service.
Yes, the vulnerability has been fixed in the Linux Kernel version v5.15.46.
To fix the vulnerability, update your Linux Kernel to version v5.15.46 or a later one.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
