CVE-2018-1094
published 2018-04-02CVE-2018-1094: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.13%
80.1th percentile
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.15.17-1 (bookworm) | linux 4.15.17-1 (bookworm) |
| linux | linux_kernel | <= 4.15.15 | — |
| linux | linux_kernel | >= 0 < 4.15.17-1 | 4.15.17-1 |
| linux | linux_kernel | >= 0 < 4.15.17-1 | 4.15.17-1 |
| linux | linux_kernel | >= 0 < 4.15.17-1 | 4.15.17-1 |
| linux | linux_kernel | >= 0 < 4.15.17-1 | 4.15.17-1 |
| linux | linux_kernel | >= 0 < 4.15.0-24.26 | 4.15.0-24.26 |
| linux | linux_kernel | >= 0 < 4.15.0-29.31 | 4.15.0-29.31 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qqjj-7xjv-r736: The ext4_fill_super function in fs/ext4/super
ghsa_unreviewed·2022-05-13
CVE-2018-1094 [HIGH] CWE-476 GHSA-qqjj-7xjv-r736: The ext4_fill_super function in fs/ext4/super
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
OSV
linux-hwe, linux-azure, linux-gcp regression
osv·2018-07-21·CVSS 5.5
CVE-2018-1108 [MEDIUM] linux-hwe, linux-azure, linux-gcp regression
linux-hwe, linux-azure, linux-gcp regression
USN-3695-2 fixed vulnerabilities in the Linux Hardware Enablement
Kernel (HWE) kernel for Ubuntu 16.04 LTS. Unfortunately, the fix
for CVE-2018-1108 introduced a regression where insufficient early
entropy prevented services from starting, leading in some situations
to a failure to boot, This update addresses the issue.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that the Linux kernel's implementation of random
seed data reported that it was in a ready state before it had gathered
sufficient entropy. An attacker could use this to expose sensitive
information. (CVE-2018-1108)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly initialize the crc32c checksum d
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem regression
osv·2018-07-21·CVSS 5.5
CVE-2018-1108 [MEDIUM] linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem regression
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem regression
USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression
where insufficient early entropy prevented services from starting,
leading in some situations to a failure to boot, This update addresses
the issue.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that the Linux kernel's implementation of random
seed data reported that it was in a ready state before it had gathered
sufficient entropy. An attacker could use this to expose sensitive
information. (CVE-2018-1108)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly initialize the crc32c checksum drive
OSV
linux-hwe, linux-azure vulnerabilities
osv·2018-07-02·CVSS 5.5
CVE-2018-1094 [MEDIUM] linux-hwe, linux-azure vulnerabilities
linux-hwe, linux-azure vulnerabilities
USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly initialize the crc32c checksum driver. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-1094)
It was discovered that the cdrom driver in the Linux kernel contained an
incorrect bounds check. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-10940)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly validate xattr sizes. A l
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
osv·2018-07-02·CVSS 5.5
CVE-2018-1094 [MEDIUM] linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly initialize the crc32c checksum driver. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-1094)
It was discovered that the cdrom driver in the Linux kernel contained an
incorrect bounds check. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-10940)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly validate xattr sizes. A local attacker could use
this to cause a denial of service (system crash). (CVE-2018-1095)
Jann Horn discovered that the 32 bit adjtimex() syscall implementation
OSV
CVE-2018-1094: The ext4_fill_super function in fs/ext4/super
osv·2018-04-02·CVSS 5.5
CVE-2018-1094 [MEDIUM] CVE-2018-1094: The ext4_fill_super function in fs/ext4/super
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
Kernel
ext4: always initialize the crc32c checksum driver
kernel_security·2018-03-29·CVSS 5.5
CVE-2018-1094 [MEDIUM] ext4: always initialize the crc32c checksum driver
ext4: always initialize the crc32c checksum driver
The extended attribute code now uses the crc32c checksum for hashing
purposes, so we should just always always initialize it. We also want
to prevent NULL pointer dereferences if one of the metadata checksum
features is enabled after the file sytsem is originally mounted.
This issue has been assigned CVE-2018-1094.
https://bugzilla.kernel.org/show_bug.cgi?id=199183
https://bugzilla.redhat.com/show_bug.cgi?id=1560788
Signed-off-by: Theodore Ts'o
Cc: [email protected]
Ubuntu
Linux kernel regression
vendor_ubuntu·2018-07-21·CVSS 5.5
CVE-2018-1108 [MEDIUM] Linux kernel regression
Title: Linux kernel regression
Summary: A regression that caused boot failures was fixed in the Linux kernel.
USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression
where insufficient early entropy prevented services from starting,
leading in some situations to a failure to boot, This update addresses
the issue.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that the Linux kernel's implementation of random
seed data reported that it was in a ready state before it had gathered
sufficient entropy. An attacker could use this to expose sensitive
information. (CVE-2018-1108)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly
Ubuntu
Linux kernel (HWE) regression
vendor_ubuntu·2018-07-21·CVSS 5.5
CVE-2018-1108 [MEDIUM] Linux kernel (HWE) regression
Title: Linux kernel (HWE) regression
Summary: A regression that caused boot failures was fixed in the Linux kernel.
USN-3695-2 fixed vulnerabilities in the Linux Hardware Enablement
Kernel (HWE) kernel for Ubuntu 16.04 LTS. Unfortunately, the fix
for CVE-2018-1108 introduced a regression where insufficient early
entropy prevented services from starting, leading in some situations
to a failure to boot, This update addresses the issue.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that the Linux kernel's implementation of random
seed data reported that it was in a ready state before it had gathered
sufficient entropy. An attacker could use this to expose sensitive
information. (CVE-2018-1108)
Wen Xu discovered that the ext4 file system implementati
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-07-02·CVSS 5.5
CVE-2018-1094 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly initialize the crc32c checksum driver. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-1094)
It was discovered that the cdrom driver in the Linux kernel contained an
incorrect bounds check. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-10940)
Wen Xu discovered that the ext4 file system implemen
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-07-02·CVSS 5.5
CVE-2018-1094 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly initialize the crc32c checksum driver. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-1094)
It was discovered that the cdrom driver in the Linux kernel contained an
incorrect bounds check. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-10940)
Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly validate xattr sizes. A local attacker could use
this to cause a denial of service (system crash). (CVE-2018-1095)
Jann Horn discovered that the 32 bit adjtimex() syscall imple
Red Hat
kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
vendor_redhat·2018-03-22·CVSS 5.5
CVE-2018-1094 [MEDIUM] CWE-476 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/xattr.c:ext4_xattr_inode_hash() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a NULL pointer dereference with a crafted ext4 image.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Fix deferred
Package: kernel (R
Debian
CVE-2018-1094: linux - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15...
vendor_debian·2018·CVSS 5.5
CVE-2018-1094 [MEDIUM] CVE-2018-1094: linux - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15...
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
Scope: local
bookworm: resolved (fixed in 4.15.17-1)
bullseye: resolved (fixed in 4.15.17-1)
forky: resolved (fixed in 4.15.17-1)
sid: resolved (fixed in 4.15.17-1)
trixie: resolved (fixed in 4.15.17-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
bugzilla·2018-03-27·CVSS 5.5
CVE-2018-1094 [MEDIUM] CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/xattr.c:ext4_xattr_inode_hash() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a NULL pointer dereference with a crafted ext4 image.
References:
https://bugzilla.kernel.org/show_bug.cgi?id=199183
http://seclists.org/oss-sec/2018/q1/284
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a45403b51582a
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=18db4b4e6fc31
Discussion:
Acknowledgments:
Name: Wen Xu
---
Created kernel tracking bugs for this issue:
Aff
Bugzilla
CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image [fedora-all]
bugzilla·2018-03-27·CVSS 5.5
CVE-2018-1094 [MEDIUM] CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image [fedora-all]
CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mes
http://openwall.com/lists/oss-security/2018/03/29/1https://access.redhat.com/errata/RHSA-2018:2948https://access.redhat.com/errata/RHSA-2018:3083https://access.redhat.com/errata/RHSA-2018:3096https://bugzilla.kernel.org/show_bug.cgi?id=199183https://bugzilla.redhat.com/show_bug.cgi?id=1560788https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=18db4b4e6fc31eda838dd1c1296d67dbcb3dc957https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=a45403b51582a87872927a3e0fc0a389c26867f1https://usn.ubuntu.com/3695-1/https://usn.ubuntu.com/3695-2/http://openwall.com/lists/oss-security/2018/03/29/1https://access.redhat.com/errata/RHSA-2018:2948https://access.redhat.com/errata/RHSA-2018:3083https://access.redhat.com/errata/RHSA-2018:3096https://bugzilla.kernel.org/show_bug.cgi?id=199183https://bugzilla.redhat.com/show_bug.cgi?id=1560788https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=18db4b4e6fc31eda838dd1c1296d67dbcb3dc957https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=a45403b51582a87872927a3e0fc0a389c26867f1https://usn.ubuntu.com/3695-1/https://usn.ubuntu.com/3695-2/
2018-04-02
Published