ext4: Incorrect Used Inodes Check False Positive
Summary
UVI-2021-1000062: ext4: fix check to prevent false positive report of incorrect used inodes. Affects Kernel versions >= 5012284700775a4e6e3fbe7eac4c543c4874b559, < e18d76a12b34791bc0318a0e0c0fa5863cd8dabf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext4 package is a file system driver for the Linux kernel. It provides support for the fourth extended file system (ext4), which is widely used in Linux distributions. The ext4 file system offers improved performance, scalability, and reliability compared to its predecessors. However, a vulnerability has been discovered in the ext4 driver that can lead to false positive reports of incorrect used inodes.
Vulnerability Detail
The vulnerability in the ext4 driver occurs due to a check that can produce false positive reports of incorrect used inodes. This means that the driver may incorrectly indicate that certain inodes are being used when they are not. While the impact and attack plausibility of this vulnerability have not been proven, it could potentially lead to incorrect file system usage statistics and mismanagement of inodes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ext4 driver in the Linux Kernel has a vulnerability that can produce false positive reports of incorrect used inodes. While the impact and attack plausibility have not been proven, it is recommended to update the Linux Kernel to version v5.12.3 or a later one to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ext4 package is a file system driver for the Linux kernel that provides support for the ext4 file system.
The impact of this vulnerability is not yet proven, but it could lead to incorrect file system usage statistics and mismanagement of inodes.
To fix this vulnerability, update your Linux Kernel to version v5.12.3 or a later one.
You can obtain the updated Linux Kernel from the official Linux Kernel repository.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
