Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Mar 2021 11:11:04 +0100
From: Greg KH <>
Subject: Re: CVE-2021-3428 Linux kernel: integer overflow in

On Wed, Mar 17, 2021 at 11:21:23AM +0530, Rohit Keshri wrote:
> Hello Team,
> A flaw was found in the Linux kernel. A denial of service problem is
> identified if an extent tree is corrupted in a crafted ext4 filesystem in
> fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow,
> A local attacker with a special user privilege may cause a system crash
> problem which can lead to an availability threat.

Please include what kernel version things like this were "found in" and
when it was fixed, otherwise you force everyone to go scramble just to
find that this was reported in July of 2020 and fixed then in the 5.9
kernel release and has already been backported to all relevant stable
kernel releases in August of last year.

In other words, no one running an updated kernel version from
is vulnerable today, right?  Are you saying that specific distro kernels
are vulnerable to this?  If so, which ones?

> 'CVE-2021-3428' was assigned by Red Hat.

Are you sure that SUSE didn't already assign one to this?

And if not, why not and why do this now?  Who is this report for?


greg k-h

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.