ext4: Fix error handling in ext4_fc_record_modified_inode()
Summary
GSD-2022-1000235: ext4: fix error handling in ext4_fc_record_modified_inode(). Affects Kernel versions < 62e46e0ffc02daa8fcfc02f7a932cc8a19601b19. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 package is a file system driver for the Linux Kernel. It provides support for the fourth extended file system (ext4) and is widely used in Linux distributions. The ext4 file system offers improved performance, scalability, and reliability compared to its predecessors. However, a vulnerability has been discovered in the ext4_fc_record_modified_inode() function, which could potentially lead to security issues.
Vulnerability Detail
The ext4_fc_record_modified_inode() function in the ext4 package has a flaw in its error handling. This vulnerability could be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The function fails to properly handle errors when recording modified inodes, which can result in data corruption or system instability. An attacker with local access to the affected system could exploit this vulnerability to disrupt normal system operations or gain unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Linux Kernel to the recommended version.
Conclusion
The ext4 package in the Linux Kernel is vulnerable to a flaw in the ext4_fc_record_modified_inode() function. This vulnerability could lead to a denial-of-service condition or potential execution of arbitrary code with elevated privileges. It is crucial to update the Linux Kernel to version v5.10.99 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with elevated privileges. It may also result in data corruption or system instability.
Any system running the affected version of the Linux Kernel with the ext4 file system driver is potentially vulnerable. It is recommended to update the kernel to the fixed version to mitigate the risk.
No, this vulnerability requires local access to the affected system to be exploited.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
