In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-devel | May 4, 2022 | Nov 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-livepatch-4.14.177-139.254-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.177-139.253-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.173-137.228Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-4.14.177-139.254Upgrade python-perfUpgrade kernel-livepatch-4.14.173-137.228-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-4.14.177-139.253Upgrade kernel-tools-develUpgrade kernel-livepatch-4.14.173-137.229-debuginfoUpgrade kernel-livepatch-4.14.181-140.257Upgrade kernelUpgrade kernel-livepatch-4.14.173-137.229Upgrade kernel-debuginfo-common-x86_64 | Jun 4, 2020 | Nov 27, 2019 |
| Amazon_linux | — | Upgrade kernel | Jun 4, 2020 | Nov 27, 2019 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Nov 5, 2020 | Nov 27, 2019 |
| Debian | — | Upgrade linux | Jun 11, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-headersUpgrade perfUpgrade kernel-debugUpgrade kernel-toolsUpgrade python-perf | Jun 17, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-develUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernelUpgrade kernel-toolsUpgrade perf | Apr 30, 2021 | Nov 27, 2019 |
| Oracle_linux | — | Upgrade kernel | Jul 22, 2024 | Nov 27, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Mar 12, 2021 | Nov 27, 2019 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 5, 2020 | Nov 27, 2019 |
| Suse | — | Upgrade kernel-azure-baseUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-default-man | Jan 15, 2020 | Nov 27, 2019 |
| Ubuntu | — | Upgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-1073-awsUpgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-184-powerpc-e500mcUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-184-genericUpgrade linux-image-snapdragonUpgrade linux-image-4.4.0-1138-snapdragonUpgrade linux-image-4.4.0-1109-awsUpgrade linux-image-powerpc-e500mcUpgrade linux-image-powerpc64-smpUpgrade linux-image-kvmUpgrade linux-image-4.4.0-184-powerpc-smpUpgrade linux-image-4.4.0-184-generic-lpaeUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-4.4.0-1075-kvmUpgrade linux-image-awsUpgrade linux-image-4.4.0-184-powerpc64-embUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-powerpc64-embUpgrade linux-image-raspi2Upgrade linux-image-lowlatencyUpgrade linux-image-powerpc-smpUpgrade linux-image-4.4.0-184-lowlatencyUpgrade linux-image-virtualUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-184-powerpc64-smpUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-4.4.0-1134-raspi2Upgrade linux-image-generic-lpaeUpgrade linux-image-generic | Jun 10, 2020 | Nov 27, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub