CVE-2015-8952

What it actually does

The mbcache feature in ext2 and ext4 mishandles xattr block caching, allowing local users to trigger soft lockups via filesystem operations involving many attributes.

Why it matters to the business

Systems may experience prolonged unresponsiveness requiring manual intervention or reboots, interrupting services and operations.

How an attack unfolds

A local attacker performs filesystem operations that exercise the mbcache path with numerous extended attributes, causing the kernel to enter a soft lockup state and deny service to other users and processes.

How to fix it

Upgrade the Linux kernel to 4.6 or later. For prometheus-postgres-exporter and related packages, update to the fixed versions 0.15.0-r10 or newer.

How to confirm the fix worked

Verify running kernel version is 4.6 or higher and confirm package versions match or exceed the stated fixed releases; test filesystem workloads with high xattr counts to ensure no lockups occur.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Create or manipulate files with large numbers of extended attributes on ext2/ext4 filesystems
3. Trigger repeated caching operations that expose the mbcache flaw
4. Induce kernel soft lockup resulting in denial of service

How to detect it

Review kernel logs for soft lockup messages during filesystem activity; correlate with processes performing heavy xattr operations on ext2/ext4 volumes.

What your security team should do

• Prioritize kernel and package upgrades on all affected systems
• Restrict local user access where possible until patches are applied
• Monitor kernel logs for soft lockup events
• Test workloads that use Ceph or Samba with many attributes