In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-devel | May 4, 2022 | Nov 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-4.14.173-137.229-debuginfoUpgrade kernel-livepatch-4.14.173-137.229Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-develUpgrade kernel-livepatch-4.14.181-140.257Upgrade kernel-tools-develUpgrade kernel-livepatch-4.14.177-139.253Upgrade kernel-livepatch-4.14.173-137.228-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.177-139.253-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-4.14.177-139.254Upgrade perfUpgrade kernel-tools-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade kernel-livepatch-4.14.177-139.254-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.173-137.228Upgrade perf-debuginfo | Jun 4, 2020 | Nov 27, 2019 |
| Amazon_linux | — | Upgrade kernel | Jun 4, 2020 | Nov 27, 2019 |
| Centos_linux | — | Upgrade kernel-rtUpgrade kernel | Nov 5, 2020 | Nov 27, 2019 |
| Debian | — | Upgrade linux | Jun 11, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernel-headersUpgrade kernel-debug-develUpgrade python-perfUpgrade kernel-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-debugUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade kernel | Jun 17, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade python-perf | Apr 30, 2021 | Nov 27, 2019 |
| Oracle_linux | — | Upgrade kernel | Jul 22, 2024 | Nov 27, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Mar 12, 2021 | Nov 27, 2019 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 5, 2020 | Nov 27, 2019 |
| Suse | — | Upgrade kernel-azure-baseUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-obs-build | Jan 15, 2020 | Nov 27, 2019 |
| Ubuntu | — | Upgrade linux-image-raspi2Upgrade linux-image-lowlatencyUpgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-powerpc-smpUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-184-lowlatencyUpgrade linux-image-4.4.0-184-powerpc64-embUpgrade linux-image-4.4.0-184-powerpc64-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-generic-lpaeUpgrade linux-image-4.4.0-1134-raspi2Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-1075-kvmUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-1138-snapdragonUpgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-awsUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-snapdragonUpgrade linux-image-powerpc-e500mcUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1073-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-powerpc64-smpUpgrade linux-image-4.4.0-184-powerpc-smpUpgrade linux-image-4.4.0-184-powerpc-e500mcUpgrade linux-image-4.4.0-184-generic-lpaeUpgrade linux-image-4.4.0-184-genericUpgrade linux-image-4.4.0-1109-aws | Jun 10, 2020 | Nov 27, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub