An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade e2fsprogs | Nov 8, 2019 | Sep 24, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libcom_errUpgrade libcom_err-develUpgrade e2fsprogs-libsUpgrade libssUpgrade e2fsprogsUpgrade e2fsprogs-staticUpgrade e2fsprogs-develUpgrade e2fsprogs-debuginfoUpgrade libss-devel | Oct 28, 2020 | Sep 24, 2019 |
| Amazon_linux | — | Upgrade e2fsprogs | Dec 19, 2020 | Sep 24, 2019 |
| Centos_linux | — | Upgrade e2fsprogs-libsUpgrade e2fsprogs-develUpgrade e2fsprogs-debuginfoUpgrade libss-develUpgrade libssUpgrade e2fsprogs-libs-debuginfoUpgrade e2fsprogs-staticUpgrade libcom_errUpgrade libss-debuginfoUpgrade libcom_err-develUpgrade e2fsprogsUpgrade libcom_err-debuginfoUpgrade e2fsprogs-debugsource | Apr 29, 2020 | Sep 24, 2019 |
| Debian | — | Upgrade e2fsprogs | Sep 30, 2019 | Sep 24, 2019 |
| Freebsd | — | Upgrade e2fsprogs | Dec 22, 2019 | Dec 21, 2019 |
| Gentoo Linux | — | Upgrade sys-fs/e2fsprogs. | Mar 13, 2020 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade e2fsprogs-libsUpgrade libcom_errUpgrade libssUpgrade e2fsprogsUpgrade e2fsprogs-develUpgrade libcom_err-devel | Feb 22, 2021 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcom_errUpgrade e2fsprogsUpgrade e2fsprogs-libsUpgrade libssUpgrade libcom_err-develUpgrade e2fsprogs-devel | Apr 30, 2021 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade e2fsprogs-develUpgrade libcom_errUpgrade libssUpgrade libcom_err-develUpgrade e2fsprogs-libsUpgrade e2fsprogs | Nov 19, 2019 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libssUpgrade libcom_err-develUpgrade e2fsprogs-libsUpgrade e2fsprogsUpgrade libcom_errUpgrade e2fsprogs-devel | Mar 24, 2020 | Sep 24, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade libssUpgrade e2fsprogs-libsUpgrade e2fsprogsUpgrade libcom_errUpgrade e2fsprogs-develUpgrade e2fsprogs-staticUpgrade libcom_err-develUpgrade libss-devel | Oct 7, 2020 | Aug 27, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Sep 24, 2019 |
| Redhat_linux | — | Upgrade libss-develUpgrade e2fsprogs-staticUpgrade e2fsprogs-develUpgrade libcom_err-develUpgrade libcom_errUpgrade e2fsprogs-debugsourceNo solution existsUpgrade e2fsprogsUpgrade libss-debuginfoUpgrade e2fsprogs-debuginfoUpgrade libcom_err-debuginfoUpgrade e2fsprogs-libsUpgrade e2fsprogs-libs-debuginfoUpgrade libss | Apr 29, 2020 | Sep 24, 2019 |
| Suse | — | Upgrade libcom_err-devel-staticUpgrade libext2fs2Upgrade libcom_err2-32bitUpgrade e2fsprogs-develUpgrade libext2fs-devel-staticUpgrade libcom_err-devel-32bitUpgrade libext2fs-devel-32bitUpgrade e2fsprogsUpgrade libcom_err2Upgrade libext2fs-develUpgrade libext2fs2-32bitUpgrade libcom_err-devel | Nov 29, 2019 | Sep 24, 2019 |
| Ubuntu | — | Upgrade e2fsprogsUpgrade e2fsprogs (Ubuntu Pro) | Oct 1, 2019 | Sep 24, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub