CVE-2009-0745

Publication date 27 February 2009

Last updated 24 July 2024

The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.

From the Ubuntu Security Team

The ext4 filesystem did not correctly clear group descriptors when resizing. A local attacker could exploit this to crash the system, leading to a denial of service.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	9.04 jaunty	Not affected
	8.10 intrepid	Fixed 2.6.27-11.31
	8.04 LTS hardy	Fixed 2.6.24-23.52
	7.10 gutsy	Not in release
	6.06 LTS dapper	Not in release
linux-source-2.6.15	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Not affected
linux-source-2.6.22	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Fixed 2.6.22-16.62
	6.06 LTS dapper	Not in release

CVE-2009-0745

From the Ubuntu Security Team

Status

References

Related Ubuntu Security Notices (USN)

Other references