Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent

[Greg KH <greg () kroah com>]

On Wed, Mar 17, 2021 at 11:21:23AM +0530, Rohit Keshri wrote:
> Hello Team,
>
> A flaw was found in the Linux kernel. A denial of service problem is
> identified if an extent tree is corrupted in a crafted ext4 filesystem in
> fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow,
> A local attacker with a special user privilege may cause a system crash
> problem which can lead to an availability threat.

Please include what kernel version things like this were "found in" and
when it was fixed, otherwise you force everyone to go scramble just to
find that this was reported in July of 2020 and fixed then in the 5.9
kernel release and has already been backported to all relevant stable
kernel releases in August of last year.

In other words, no one running an updated kernel version from kernel.org
is vulnerable today, right?  Are you saying that specific distro kernels
are vulnerable to this?  If so, which ones?

> 'CVE-2021-3428' was assigned by Red Hat.

Are you sure that SUSE didn't already assign one to this?

And if not, why not and why do this now?  Who is this report for?

thanks,

greg k-h