Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 243150 (CVE-2008-3528)

Summary: Kernel: DOS via printk (CVE-2008-3528)
Product: Gentoo Security Reporter: Stefan Behte (RETIRED) <craig>
Component: KernelAssignee: Gentoo Security <security>
Severity: normal CC: kernel
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: [linux <] [linux >=2.6.26 <] [linux >=2.6.27 <]
Package list:
Runtime testing required: ---

Description Stefan Behte (RETIRED) gentoo-dev Security 2008-10-21 22:21:21 UTC
CVE-2008-3528 (
  The error-reporting functionality in (1) fs/ext2/dir.c, (2)
  fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel does not limit the number of printk console messages that
  report directory corruption, which allows physically proximate
  attackers to cause a denial of service (temporary system hang) by
  mounting a filesystem that has corrupted dir->i_size and
  dir->i_blocks values and performing (a) read or (b) write operations.
   NOTE: there are limited scenarios in which this crosses privilege
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2008-10-21 22:24:49 UTC
Excluding hardened, as they do not have

Upstream commits:
- bd39597cbd42a784105a04010100e27267481c67 (ext2)
- cdbf6dba28e8e6268c8420857696309470009fd9 (ext3)
- 9d9f177572d9e4eba0f2e18523b44f90dd51fe74 (ext4)