CVE-2011-4086
Priority
Medium
Description
The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux
kernel before 3.3.1 does not properly handle the _Delay and _Unwritten
buffer head states, which allows local users to cause a denial of service
(system crash) by leveraging the presence of an ext4 filesystem that was
mounted with a journal.
kernel before 3.3.1 does not properly handle the _Delay and _Unwritten
buffer head states, which allows local users to cause a denial of service
(system crash) by leveraging the presence of an ext4 filesystem that was
mounted with a journal.
Ubuntu-Description
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service.
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086
https://rhn.redhat.com/errata/RHSA-2012-0107.html
http://thread.gmane.org/gmane.comp.file-systems.ext4/30623
http://www.ubuntu.com/usn/usn-1431-1
http://www.ubuntu.com/usn/usn-1433-1
http://www.ubuntu.com/usn/usn-1432-1
http://www.ubuntu.com/usn/usn-1440-1
http://www.ubuntu.com/usn/usn-1445-1
http://www.ubuntu.com/usn/usn-1446-1
http://www.ubuntu.com/usn/usn-1453-1
http://www.ubuntu.com/usn/usn-1454-1
http://www.ubuntu.com/usn/usn-1458-1
https://rhn.redhat.com/errata/RHSA-2012-0107.html
http://thread.gmane.org/gmane.comp.file-systems.ext4/30623
http://www.ubuntu.com/usn/usn-1431-1
http://www.ubuntu.com/usn/usn-1433-1
http://www.ubuntu.com/usn/usn-1432-1
http://www.ubuntu.com/usn/usn-1440-1
http://www.ubuntu.com/usn/usn-1445-1
http://www.ubuntu.com/usn/usn-1446-1
http://www.ubuntu.com/usn/usn-1453-1
http://www.ubuntu.com/usn/usn-1454-1
http://www.ubuntu.com/usn/usn-1458-1
Notes
apw> This is sitting in Ted Ts'o's dev tree presumably waiting on the 3.4
apw> merge window, the issue is masked from v3.2 onwards by other commits.
apw> The commit itself is marked for stable and for now I suspect we should
apw> wait for it. We have no stable commit id as yet, see:
apw> jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
apw> this has now appeared upstream (see below)
apw> merge window, the issue is masked from v3.2 onwards by other commits.
apw> The commit itself is marked for stable and for now I suspect we should
apw> wait for it. We have no stable commit id as yet, see:
apw> jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
apw> this has now appeared upstream (see below)
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-1602.5) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.2.0-1602.5) |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (2.6.32-345.48) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (3.0.0-19.32~lucid1) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (2.6.38-15.59~lucid1) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Patches:
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (2.6.32-41.89) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-22.35) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.2.0-22.35) |
| Ubuntu 13.04 (Raring Ringtail): | not-affected (3.2.0-22.35) |
| Ubuntu 13.10 (Saucy Salamander): | not-affected (3.2.0-22.35) |
Patches:
| Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | Fixed by 15291164b22a357cb211b618adfef4fa82fc0de3 |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-1412.15) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.2.0-1412.15) |
| Ubuntu 13.04 (Raring Ringtail): | not-affected (3.2.0-1412.15) |
| Ubuntu 13.10 (Saucy Salamander): | not-affected (3.2.0-1412.15) |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | released (3.4~rc1) |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |