Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
The product writes data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://usn.ubuntu.com/3752-2/ | third party advisory vendor advisory |
| https://usn.ubuntu.com/3752-3/ | third party advisory vendor advisory |
| https://access.redhat.com/errata/RHSA-2019:0162 | third party advisory vendor advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10840 | patch exploit third party advisory issue tracking |
| http://www.securityfocus.com/bid/104858 | third party advisory vdb entry |
| https://usn.ubuntu.com/3752-1/ | third party advisory vendor advisory |