lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240227184057.2368370-11-gregkh@linuxfoundation.org> Date: Tue, 27 Feb 2024 19:40:48 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2021-46946: ext4: fix check to prevent false positive report of incorrect used inodes Description =========== In the Linux kernel, the following vulnerability has been resolved: ext4: fix check to prevent false positive report of incorrect used inodes Commit <50122847007> ("ext4: fix check to prevent initializing reserved inodes") check the block group zero and prevent initializing reserved inodes. But in some special cases, the reserved inode may not all belong to the group zero, it may exist into the second group if we format filesystem below. mkfs.ext4 -b 4096 -g 8192 -N 1024 -I 4096 /dev/sda So, it will end up triggering a false positive report of a corrupted file system. This patch fix it by avoid check reserved inodes if no free inode blocks will be zeroed. The Linux kernel CVE team has assigned CVE-2021-46946 to this issue. Affected and fixed versions =========================== Issue introduced in 4.4.148 with commit 7736fcede789 and fixed in 4.4.269 with commit 539ba4ebc467 Issue introduced in 4.9.120 with commit 954e572ae2f2 and fixed in 4.9.269 with commit d2e121be8d31 Issue introduced in 4.14.60 with commit f547aa20b4f6 and fixed in 4.14.233 with commit e70db6e43286 Issue introduced in 4.18 with commit 50122847007 and fixed in 4.19.191 with commit 7687f5aba0f5 Issue introduced in 4.18 with commit 50122847007 and fixed in 5.4.118 with commit 9c61387630a5 Issue introduced in 4.18 with commit 50122847007 and fixed in 5.10.36 with commit 098b257563b9 Issue introduced in 4.18 with commit 50122847007 and fixed in 5.11.20 with commit f42789ee5f96 Issue introduced in 4.18 with commit 50122847007 and fixed in 5.12.3 with commit e18d76a12b34 Issue introduced in 4.18 with commit 50122847007 and fixed in 5.13 with commit a149d2a5cabb Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-46946 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ext4/ialloc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/539ba4ebc467260225898e67ea53cbb73308f894 https://git.kernel.org/stable/c/d2e121be8d318524a61e13ca15b5bfab2d0b63c7 https://git.kernel.org/stable/c/e70db6e43286a17c3dfc840fcee662de183b6a81 https://git.kernel.org/stable/c/7687f5aba0f50c7ff8040e506bae184e59c8e7b8 https://git.kernel.org/stable/c/9c61387630a54e35b96a90608aafd369ffb86f39 https://git.kernel.org/stable/c/098b257563b959f4ca6c1d82fde0ee727792cb19 https://git.kernel.org/stable/c/f42789ee5f96743cdb5f69445cab3609458733f7 https://git.kernel.org/stable/c/e18d76a12b34791bc0318a0e0c0fa5863cd8dabf https://git.kernel.org/stable/c/a149d2a5cabbf6507a7832a1c4fd2593c55fd450
Powered by blists - more mailing lists