Bug 1768555 (CVE-2019-5094)
| Summary: | CVE-2019-5094 e2fsprogs: Crafted ext4 partition leads to out-of-bounds write | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | esandeen, josef, kasal, kzak, lczerner, oliver, sct |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | e2fprogs 1.45.4 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:34:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1768556, 1768709, 1768710, 1783777, 1792192 | ||
| Bug Blocks: | 1768557 | ||
|
Description
Guilherme de Almeida Suckevicz
2019-11-04 17:32:12 UTC
Created e2fsprogs tracking bugs for this issue: Affects: fedora-all [bug 1768556] This is fixed by:
commit 8dbe7b475ec5e91ed767239f0e85880f416fc384
Author: Theodore Ts'o <tytso>
Date: Sun Sep 1 00:59:16 2019 -0400
libsupport: add checks to prevent buffer overrun bugs in quota code
A maliciously corrupted file systems can trigger buffer overruns in
the quota code used by e2fsck. To fix this, add sanity checks to the
quota header fields as well as to block number references in the quota
tree.
Addresses: CVE-2019-5094
Addresses: TALOS-2019-0887
Signed-off-by: Theodore Ts'o <tytso>
Analysis notes: This flaw is triggered by a malformed/specially-crafted ext2/3/4 partition. You need to run the e2fsck utility on the said partition in order to trigger the flaw. Since the e2fsck cannot only be run as a privileged user, the attacker will need to social engineer/convince the system administrator to run this utility on the corrupted partition. Also the corrupted partition will first need to exists on the system either via a locally attached hard drive or a network device. Based on the above, it seems like exploiting this flaw will need some previous privileged access on the system by the attacker. Upstream commit: https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?id=8dbe7b475ec5e91ed767239f0e85880f416fc384 External References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1913 https://access.redhat.com/errata/RHSA-2020:1913 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-5094 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4011 https://access.redhat.com/errata/RHSA-2020:4011 |