ext4: Bug in Handling Dirty Pages without Permission
Summary
GSD-2022-1001152: ext4: don't BUG if someone dirty pages without asking ext4 first. Affects Kernel versions < 677c9d30e8487bee6c8e3b034070319d98f6e203. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 package is a file system driver for the Linux Kernel. It provides support for the fourth extended file system (ext4) and is widely used in Linux distributions. The ext4 file system is known for its performance, scalability, and reliability. However, a vulnerability has been discovered in the ext4 driver that allows someone to dirty pages without obtaining permission from ext4 first.
Vulnerability Detail
The vulnerability in the ext4 driver allows an attacker to dirty pages without notifying ext4. This can lead to data corruption and other unexpected behavior. The vulnerability has the potential to be exploited by an attacker with local access to the system. By bypassing ext4's permission checks, an attacker can modify data on the file system without detection. This can result in unauthorized access, data loss, or even a complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above by updating the Linux Kernel to the latest version.
Conclusion
The ext4 driver in the Linux Kernel has a vulnerability that allows unauthorized modification of data on the file system. This vulnerability has been fixed in the Linux Kernel version v5.17.2. Users are advised to update their Linux Kernel to the latest version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ext4 is a file system driver for the Linux Kernel that provides support for the fourth extended file system (ext4). It is widely used in Linux distributions.
The vulnerability allows an attacker to modify data on the file system without detection, potentially leading to unauthorized access, data loss, or system compromise.
Users of Linux systems with the ext4 file system driver are affected by this vulnerability.
Yes, the vulnerability has been fixed in the Linux Kernel version v5.17.2.
To update your Linux Kernel, download the latest kernel source code from the official Linux Kernel repository and compile it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
