e2fsprogs: Arbitrary Code Execution — GLSA 202402-15

A vulnerability has been discovered in e2fsprogs which can lead to arbitrary code execution.

Affected packages

Package	sys-fs/e2fsprogs on all architectures
Affected versions	< 1.46.6
Unaffected versions	>= 1.46.6

Background

e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems.

Description

Multiple vulnerabilities have been discovered in e2fsprogs. Please review the CVE identifiers referenced below for details.

Impact

An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Workaround

There is no known workaround at this time.

Resolution

All e2fsprogs users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.46.6"

References

CVE-2022-1304

Release date
February 18, 2024

Latest revision
February 18, 2024: 1

Severity
high

Exploitable
local

Bugzilla entries

838388