Date: Wed, 17 Mar 2021 11:11:04 +0100 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent On Wed, Mar 17, 2021 at 11:21:23AM +0530, Rohit Keshri wrote: > Hello Team, > > A flaw was found in the Linux kernel. A denial of service problem is > identified if an extent tree is corrupted in a crafted ext4 filesystem in > fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, > A local attacker with a special user privilege may cause a system crash > problem which can lead to an availability threat. Please include what kernel version things like this were "found in" and when it was fixed, otherwise you force everyone to go scramble just to find that this was reported in July of 2020 and fixed then in the 5.9 kernel release and has already been backported to all relevant stable kernel releases in August of last year. In other words, no one running an updated kernel version from kernel.org is vulnerable today, right? Are you saying that specific distro kernels are vulnerable to this? If so, which ones? > 'CVE-2021-3428' was assigned by Red Hat. Are you sure that SUSE didn't already assign one to this? And if not, why not and why do this now? Who is this report for? thanks, greg k-h
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.