Bug 919032 (CVE-2015-0275)

Summary: VUL-0: CVE-2015-0275: kernel: fs: ext4: fallocate zero range page size > block size BUG()
Product: [Novell Products] SUSE Security Incidents Reporter: Johannes Segitz <jsegitz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: bpetkov, mhocko, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/114155/
Whiteboard: CVSSv2:RedHat:CVE-2015-0275:4.7:(AV:L/AC:M/Au:N/C:N/I:N/A:C) CVSSv2:NVD:CVE-2015-0275:4.9:(AV:L/AC:L/Au:N/C:N/I:N/A:C)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Johannes Segitz 2015-02-23 11:28:48 UTC

Currently there is a bug in zero range code which causes zero range
calls to only allocate block aligned portion of the range, while
ignoring the rest in some cases.

In some cases, namely if the end of the range is past isize, we do
attempt to preallocate the last nonaligned block. However this might
cause kernel to BUG() in some carefully designed zero range requests on
setups where page size > block size.

Fix: http://www.spinics.net/lists/linux-ext4/msg47193.html

Comment 1 Swamp Workflow Management 2015-02-23 23:01:05 UTC
bugbot adjusting priority
Comment 2 Jan Kara 2015-04-08 13:19:37 UTC
Zero range functionality has been added in kernel 3.15-rc1. Thus the only affected branch is openSUSE-13.2. I've pushed the fix there so the bug is done from my side.

Reassigning to security team for tracking.
Comment 3 Marcus Meissner 2016-03-23 08:28:13 UTC