ext2: Correct Max File Size Computing in Linux Kernel
Summary
GSD-2022-1002436: ext2: correct max file size computing. Affects Kernel versions >= 7412f34ff819f530461bfe57773f83e1d4419421, < 94fe9ee8d6d48235b44e14820c07271be3c25cff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, including file systems. The ext2 file system is one of the supported file systems in the Linux Kernel. It is the second extended file system and offers features like support for large file sizes and efficient storage allocation.
However, a vulnerability has been discovered in the ext2 file system implementation in the Linux Kernel. This vulnerability affects versions starting from v4.14.108 up to v4.14.275. It can potentially lead to incorrect computation of the maximum file size, which may have security implications and impact the overall stability and reliability of the system.
Vulnerability Detail
The vulnerability in the ext2 file system implementation arises from a flaw in the computation of the maximum file size. Due to this flaw, the maximum file size can be incorrectly determined, potentially allowing files to exceed the intended size limits. This could result in data corruption, file system instability, and even potential security breaches.
The vulnerability was introduced in version v4.14.108 of the Linux Kernel by commit 7412f34ff819f530461bfe57773f83e1d4419421. It has been addressed in version v4.14.276 by commit 94fe9ee8d6d48235b44e14820c07271be3c25cff.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the file size manually by enforcing strict file size limits within their applications or by implementing custom checks in the file system layer. However, this workaround may not provide complete protection and should be considered a temporary measure until the kernel is updated.
Conclusion
The ext2 file system vulnerability in the Linux Kernel can lead to incorrect computation of the maximum file size, potentially resulting in data corruption, file system instability, and security breaches. It is crucial to update the Linux Kernel to version v4.14.276 or later to mitigate this vulnerability. Users can also use tools like Vulert (https://vulert.com) to check if their systems are affected and receive real-time monitoring and alerts for open-source vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to incorrect computation of the maximum file size in the ext2 file system, potentially resulting in data corruption, file system instability, and security breaches.
Versions starting from v4.14.108 up to v4.14.275 are affected by this vulnerability.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
A temporary workaround is to enforce strict file size limits within applications or implement custom checks in the file system layer. However, it is recommended to update the Linux Kernel to the patched version as soon as possible.
The official Linux Kernel repository can be found at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
