CVE-2015-0275

What it actually does

Local process can trigger a kernel BUG in ext4_zero_range via a malformed fallocate zero-range request, causing immediate system crash or panic on affected kernels before 4.1.

Why it matters to the business

Unprivileged local users can force unplanned reboots or downtime on Linux servers and workstations, disrupting operations and availability without remote access or elevated privileges.

How an attack unfolds

An attacker with local shell access crafts a specific fallocate system call targeting an ext4 filesystem, passing parameters that exercise an unhandled code path in extents.c and force the kernel into a BUG state.

How to fix it

Upgrade the Linux kernel to version 4.1 or later on all affected distributions; apply vendor backports where available for supported long-term releases; reboot after kernel update.

How to confirm the fix worked

Confirm kernel version is 4.1 or newer; attempt to reproduce the original fallocate zero-range test case on a non-production system and verify it no longer triggers a BUG; review kernel changelog for the ext4 extents fix.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Identify ext4 filesystem mount points
3. Invoke fallocate with crafted zero-range parameters
4. Trigger kernel BUG and system crash or hang

How to detect it

Search kernel logs and crash dumps for BUG entries originating from fs/ext4/extents.c or ext4_zero_range; correlate with fallocate system call traces from auditd or strace on systems that experienced unexpected reboots.

• BUG: unable to handle kernel NULL pointer dereference in ext4_zero_range
• kernel BUG at fs/ext4/extents.c

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant systems within standard patch windows
• Restrict local user accounts and use mandatory access controls to limit fallocate usage where possible
• Monitor kernel logs for ext4 BUG reports as an ongoing detection measure