Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2018-13097: Linux kernel may crash on corrupted F2FS file system
CVE-2018-13097 · published 8 years ago
Summary
The Linux kernel versions up to 4.17.3 used in Ubuntu cloud images (such as canonical/linux-aws, canonical/linux-azure, and related releases) can read invalid data from a damaged F2FS file system, causing a crash or freeze. This happens because the kernel miscalculates a block count and tries to read beyond memory or divides by zero. Update the kernel to a newer released version or apply the vendor's patch to prevent the crash, and avoid using corrupted F2FS images.
What to do
- Update canonical linux-aws to version 4.4.0-1040.43.
- Update canonical linux-lts-xenial to version 4.4.0-144.170~14.04.1.
- Update canonical linux-azure to version 4.15.0-1059.64~14.04.1.
- Update canonical linux to version 4.4.0-145.171.
- Update canonical linux-aws to version 4.4.0-1079.89.
- Update canonical linux-aws-hwe to version 4.15.0-1047.49~16.04.1.
- Update canonical linux-azure to version 4.15.0-1055.60.
- Update canonical linux-gcp to version 4.15.0-1040.42~16.04.1.
- Update canonical linux-hwe to version 4.15.0-58.64~16.04.1.
- Update canonical linux-kvm to version 4.4.0-1043.49.
- Update canonical linux-oracle to version 4.15.0-1021.23~16.04.1.
- Update canonical linux-raspi2 to version 4.4.0-1106.114.
- Update canonical linux-snapdragon to version 4.4.0-1110.115.
- Update canonical linux-fips to version 4.4.0-1008.10.
- Update canonical linux to version 4.15.0-58.64.
- Update canonical linux-aws to version 4.15.0-1047.49.
- Update canonical linux-azure to version 5.0.0-1014.14~18.04.1.
- Update canonical linux-gcp to version 4.15.0-1040.42.
- Update canonical linux-gke-4.15 to version 4.15.0-1040.42.
- Update canonical linux-hwe to version 5.0.0-23.24~18.04.1.
- Update canonical linux-kvm to version 4.15.0-1042.42.
- Update canonical linux-oem to version 4.15.0-1050.57.
- Update canonical linux-oracle to version 4.15.0-1021.23.
- Update canonical linux-raspi2 to version 4.15.0-1043.46.
- Update canonical linux-snapdragon to version 4.15.0-1060.66.
- Update canonical linux-aws-fips to version 4.15.0-2018.18.
- Update canonical linux-azure-fips to version 4.15.0-2006.7.
- Update debian linux to version 4.19.9-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:14.04:LTS | canonical | linux-aws |
< 4.4.0-1040.43 Fix: upgrade to 4.4.0-1040.43
|
| Ubuntu:14.04:LTS | canonical | linux-lts-xenial |
< 4.4.0-144.170~14.04.1 Fix: upgrade to 4.4.0-144.170~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure |
< 4.15.0-1059.64~14.04.1 Fix: upgrade to 4.15.0-1059.64~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:16.04:LTS | canonical | linux |
< 4.4.0-145.171 Fix: upgrade to 4.4.0-145.171
|
| Ubuntu:16.04:LTS | canonical | linux-aws |
< 4.4.0-1079.89 Fix: upgrade to 4.4.0-1079.89
|
| Ubuntu:16.04:LTS | canonical | linux-aws-hwe |
< 4.15.0-1047.49~16.04.1 Fix: upgrade to 4.15.0-1047.49~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.15.0-1055.60 Fix: upgrade to 4.15.0-1055.60
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1040.42~16.04.1 Fix: upgrade to 4.15.0-1040.42~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.15.0-58.64~16.04.1 Fix: upgrade to 4.15.0-58.64~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-kvm |
< 4.4.0-1043.49 Fix: upgrade to 4.4.0-1043.49
|
| Ubuntu:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1021.23~16.04.1 Fix: upgrade to 4.15.0-1021.23~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-raspi2 |
< 4.4.0-1106.114 Fix: upgrade to 4.4.0-1106.114
|
| Ubuntu:16.04:LTS | canonical | linux-snapdragon |
< 4.4.0-1110.115 Fix: upgrade to 4.4.0-1110.115
|
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips |
< 4.4.0-1008.10 Fix: upgrade to 4.4.0-1008.10
|
| Ubuntu:18.04:LTS | canonical | linux |
< 4.15.0-58.64 Fix: upgrade to 4.15.0-58.64
|
| Ubuntu:18.04:LTS | canonical | linux-aws |
< 4.15.0-1047.49 Fix: upgrade to 4.15.0-1047.49
|
| Ubuntu:18.04:LTS | canonical | linux-azure |
< 5.0.0-1014.14~18.04.1 Fix: upgrade to 5.0.0-1014.14~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp |
< 4.15.0-1040.42 Fix: upgrade to 4.15.0-1040.42
|
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 |
< 4.15.0-1040.42 Fix: upgrade to 4.15.0-1040.42
|
| Ubuntu:18.04:LTS | canonical | linux-hwe |
< 5.0.0-23.24~18.04.1 Fix: upgrade to 5.0.0-23.24~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-kvm |
< 4.15.0-1042.42 Fix: upgrade to 4.15.0-1042.42
|
| Ubuntu:18.04:LTS | canonical | linux-oem |
< 4.15.0-1050.57 Fix: upgrade to 4.15.0-1050.57
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1021.23 Fix: upgrade to 4.15.0-1021.23
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1043.46 Fix: upgrade to 4.15.0-1043.46
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1060.66 Fix: upgrade to 4.15.0-1060.66
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips |
< 4.15.0-2018.18 Fix: upgrade to 4.15.0-2018.18
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips |
< 4.15.0-2006.7 Fix: upgrade to 4.15.0-2006.7
|
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:26.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:26.04:LTS | canonical | linux-nvidia-bos | All versions |
| Debian:12 | debian | linux |
< 4.19.9-1 Fix: upgrade to 4.19.9-1
|
| Debian:13 | debian | linux |
< 4.19.9-1 Fix: upgrade to 4.19.9-1
|
| Debian:14 | debian | linux |
< 4.19.9-1 Fix: upgrade to 4.19.9-1
|
| – | linux | linux_kernel |
<= 4.17.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, ...
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a denial of service (BUG).
References
- https://ubuntu.com/security/CVE-2018-13097 Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=f2fs-de... Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=f2fs-de... Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&i... Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-13097 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2018-13097 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html
- http://packetstormsecurity.com/files/151420/Slackware-Security-Advisory-Slackwar...
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d...
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://seclists.org/bugtraq/2019/Jan/52
- https://usn.ubuntu.com/3932-1/
- https://usn.ubuntu.com/3932-2/
- https://usn.ubuntu.com/4094-1/
- https://usn.ubuntu.com/4118-1/
- https://bugzilla.kernel.org/show_bug.cgi?id=200171 Third Party Advisory
- https://ubuntu.com/security/notices/USN-3932-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3932-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4094-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4118-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
CWE-369Divide By Zero
Timeline
Published3 Jul 2018
Updated3 Nov 2026
First seen2 Jul 2026
Track software like this
Free during beta