An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade e2fsprogs | Nov 8, 2019 | Sep 24, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libssUpgrade e2fsprogs-staticUpgrade e2fsprogsUpgrade libcom_err-develUpgrade e2fsprogs-libsUpgrade libcom_errUpgrade e2fsprogs-develUpgrade e2fsprogs-debuginfoUpgrade libss-devel | Oct 28, 2020 | Sep 24, 2019 |
| Amazon_linux | — | Upgrade e2fsprogs | Dec 19, 2020 | Sep 24, 2019 |
| Centos_linux | — | Upgrade e2fsprogs-libs-debuginfoUpgrade e2fsprogs-staticUpgrade libssUpgrade e2fsprogsUpgrade e2fsprogs-debugsourceUpgrade libcom_err-debuginfoUpgrade libcom_err-develUpgrade libcom_errUpgrade libss-debuginfoUpgrade e2fsprogs-develUpgrade e2fsprogs-debuginfoUpgrade e2fsprogs-libsUpgrade libss-devel | Apr 29, 2020 | Sep 24, 2019 |
| Debian | — | Upgrade e2fsprogs | Sep 30, 2019 | Sep 24, 2019 |
| Freebsd | — | Upgrade e2fsprogs | Dec 22, 2019 | Dec 21, 2019 |
| Gentoo Linux | — | Upgrade sys-fs/e2fsprogs. | Mar 13, 2020 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade e2fsprogsUpgrade libssUpgrade e2fsprogs-libsUpgrade libcom_errUpgrade e2fsprogs-develUpgrade libcom_err-devel | Feb 22, 2021 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcom_errUpgrade e2fsprogsUpgrade e2fsprogs-libsUpgrade libssUpgrade e2fsprogs-develUpgrade libcom_err-devel | Apr 30, 2021 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libcom_err-develUpgrade e2fsprogs-libsUpgrade e2fsprogsUpgrade libssUpgrade e2fsprogs-develUpgrade libcom_err | Nov 19, 2019 | Sep 24, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcom_err-develUpgrade e2fsprogsUpgrade e2fsprogs-libsUpgrade libssUpgrade libcom_errUpgrade e2fsprogs-devel | Mar 24, 2020 | Sep 24, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade e2fsprogsUpgrade libssUpgrade libcom_errUpgrade e2fsprogs-libsUpgrade libss-develUpgrade e2fsprogs-develUpgrade libcom_err-develUpgrade e2fsprogs-static | Oct 7, 2020 | Aug 27, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Sep 24, 2019 |
| Redhat_linux | — | Upgrade e2fsprogsNo solution existsUpgrade libcom_err-debuginfoUpgrade e2fsprogs-debuginfoUpgrade e2fsprogs-libsUpgrade libssUpgrade e2fsprogs-debugsourceUpgrade libss-debuginfoUpgrade libcom_errUpgrade e2fsprogs-libs-debuginfoUpgrade libss-develUpgrade e2fsprogs-develUpgrade e2fsprogs-staticUpgrade libcom_err-devel | Apr 29, 2020 | Sep 24, 2019 |
| Suse | — | Upgrade libext2fs-devel-staticUpgrade libext2fs-devel-32bitUpgrade libcom_err-devel-32bitUpgrade libcom_err-devel-staticUpgrade libcom_err2-32bitUpgrade e2fsprogs-develUpgrade libext2fs2Upgrade libext2fs2-32bitUpgrade libext2fs-develUpgrade e2fsprogsUpgrade libcom_err-develUpgrade libcom_err2 | Nov 29, 2019 | Sep 24, 2019 |
| Ubuntu | — | Upgrade e2fsprogsUpgrade e2fsprogs (Ubuntu Pro) | Oct 1, 2019 | Sep 24, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub