Vulnerability in btrfs: fixup error handling in fixup_inode_link_counts
Summary
UVI-2021-1000735: btrfs: fixup error handling in fixup_inode_link_counts. Affects Kernel versions < 0c7086ee625e0a12474fc63824a4a8dfab663838. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The btrfs package is a part of the Linux Kernel ecosystem and is responsible for providing support for the B-tree file system. It offers advanced features such as snapshots, pooling, and checksums. The vulnerability in question relates to the error handling in the fixup_inode_link_counts function within the btrfs package.
Vulnerability Detail
The vulnerability arises from improper error handling in the fixup_inode_link_counts function of the btrfs package. This flaw could potentially be exploited by an attacker to trigger a denial-of-service condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in an unknown version and has been fixed in Linux Kernel version v4.14.236 by commit 0c7086ee625e0a12474fc63824a4a8dfab663838.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the btrfs package in the Linux Kernel was found to have a vulnerability related to error handling in the fixup_inode_link_counts function. This vulnerability has been fixed in Linux Kernel version v4.14.236. It is recommended to update the kernel to the latest version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially lead to a denial-of-service condition or allow an attacker to execute arbitrary code with elevated privileges.
You can check if your system is affected by this vulnerability by verifying the version of the Linux Kernel installed. If the version is earlier than v4.14.236, it is recommended to update to the latest version.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the vulnerability has been patched in Linux Kernel version v4.14.236.
You can find more information about this vulnerability in the Open Source Vulnerability database entry UVI-2021-1000735 (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000735.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
