[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YFHVuDKj+oMwxBZX@kroah.com>
Date: Wed, 17 Mar 2021 11:11:04 +0100
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2021-3428 Linux kernel: integer overflow in
ext4_es_cache_extent
On Wed, Mar 17, 2021 at 11:21:23AM +0530, Rohit Keshri wrote:
> Hello Team,
>
> A flaw was found in the Linux kernel. A denial of service problem is
> identified if an extent tree is corrupted in a crafted ext4 filesystem in
> fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow,
> A local attacker with a special user privilege may cause a system crash
> problem which can lead to an availability threat.
Please include what kernel version things like this were "found in" and
when it was fixed, otherwise you force everyone to go scramble just to
find that this was reported in July of 2020 and fixed then in the 5.9
kernel release and has already been backported to all relevant stable
kernel releases in August of last year.
In other words, no one running an updated kernel version from kernel.org
is vulnerable today, right? Are you saying that specific distro kernels
are vulnerable to this? If so, which ones?
> 'CVE-2021-3428' was assigned by Red Hat.
Are you sure that SUSE didn't already assign one to this?
And if not, why not and why do this now? Who is this report for?
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
