CVE-2023-34256

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4groupdesccsum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend again...

Amazon Linux AMI : kernel (ALAS-2023-1744)

The version of kernel installed on the remote host is prior to 4.14.314-164.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1744 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inod...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

kernel: Linux kernel ext4: Information Disclosure via uninitialized memory leak in fast-commit journal

A flaw was found in the Linux kernel. A local attacker could exploit an information disclosure vulnerability by not properly zeroing out unused space at the end of fast-commit journal blocks in the ext4 filesystem. This could lead to the leakage of uninitialized memory to disk, potentially allowi...

kernel: ext4: don't set up encryption key during jbd2 transaction

A flaw exists in the ext4 filesystem implementation in the Linux kernel such that the function ext4unlink extended a journaling transaction too far so that it included a call to ext4findentry. However, ext4findentry may need to set up a directory’s encryption key — which can cause a deadlock when...

kernel: ext4: fix deadlock due to mbcache entry corruption

A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute xattr blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4xattrblockset where the co...

kernel: Linux kernel (ext4): Memory leak due to improper handling of krealloc failure

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs due to improper handling of memory allocation failures when the krealloc function returns NULL within ext4fcrecordmodifiedinode. A local user could potentially exploit this flaw, leading to a memory leak. This memor...

PT-2025-41051

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc4-syzkaller-62821-gcb231e2f67ec Description The Linux kernel contains a flaw in the ext4 filesystem implementation. Specifically, the ext4 evict inode function accesses an uninitialized value, potentially...

CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

AZL-26689 CVE-2023-2513 affecting package kernel for versions less than 5.15.112.1-1

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

Design/Logic Flaw

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

Ubuntu: Security Advisory (USN-6001-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM : Linux kernel (AWS) vulnerabilities (USN-6001-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6001-1 advisory. Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A...

DEBIAN-CVE-2023-1252

A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 "ovl: fix use...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a memory misreference vulnerability that stems from a mix-up in the instructions responsible for freeing memory in the Ext4 file system, which cou...

K94735334: Linux kernel vulnerability CVE-2018-10883

Security Advisory Description A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2journaldirtymetadata, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. CVE-2018-10883 Impact A local user...

SUSE CVE-2009-0746

The makeindexeddir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain reclen field, which allows local users to cause a denial of service OOPS by attempting to mount a crafted ext4 filesystem...