Race condition in Linux kernel - CVE-2015-8839
Published: May 2, 2016 / Updated: October 2, 2020
Vulnerability identifier: #VU91494
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8839
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a race condition within the init_once() function in fs/ext4/super.c, within the ext4_punch_hole(), ext4_setattr(), ext4_page_mkwrite() and block_page_mkwrite_return() functions in fs/ext4/inode.c, within the ext4_dax_fault() and ext4_dax_pmd_fault() functions in fs/ext4/file.c, within the ext4_zero_range(), ext4_collapse_range() and ext4_insert_range() functions in fs/ext4/extents.c. A local non-authenticated attacker can perform a denial of service (DoS) attack.
Affected software
Linux kernel
Fedora
kernel
Fedora
kernel
How to mitigate CVE-2015-8839
Install update from vendor's website.
kernel - addressed in versions 4.4.7-200.fc22, 4.4.7-300.fc23, 4.4.8-200.fc22
External References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
- http://www.openwall.com/lists/oss-security/2016/04/01/4
- http://www.securityfocus.com/bid/85798
- http://www.securitytracker.com/id/1035455
- http://www.ubuntu.com/usn/USN-3005-1
- http://www.ubuntu.com/usn/USN-3006-1
- http://www.ubuntu.com/usn/USN-3007-1
- https://access.redhat.com/errata/RHSA-2017:1842
- https://access.redhat.com/errata/RHSA-2017:2077
- https://access.redhat.com/errata/RHSA-2017:2669
- https://bugzilla.redhat.com/show_bug.cgi?id=1323577
- https://github.com/torvalds/linux/commit/ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
- https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html