CVE-2018-10323

What it actually does

Local user can trigger a NULL pointer dereference inside xfs_bmapi_write when the kernel processes a crafted XFS filesystem image during extent-to-btree conversion in xfs_bmap_extents_to_btree.

Why it matters to the business

Local users on affected Linux, Ubuntu, and Debian systems can crash the kernel on demand, causing system downtime and potential data loss for workloads using XFS; the vulnerability has been public for over eight years with an exploit available but low exploitation probability.

How an attack unfolds

An attacker prepares a malformed XFS image that exercises the buggy code path, then causes the kernel to mount or otherwise process the image (for example via loopback mount or filesystem utilities), resulting in the NULL dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the xfs_bmap_extents_to_btree NULL dereference; apply the latest available kernel packages from the distribution vendor for all affected systems.

How to confirm the fix worked

Verify that the running kernel version is newer than 4.16.3 and that the xfs_bmap.c source no longer contains the vulnerable code path; test by attempting to mount a known-bad image and confirming the kernel does not panic.

Typical attack path

1. Craft a malicious XFS filesystem image that reaches xfs_bmap_extents_to_btree with invalid extent data
2. Place the image on a system where the attacker has local access
3. Trigger the kernel to parse the image (mount, fsck, or backup tools)
4. Observe NULL pointer dereference in xfs_bmapi_write leading to denial of service

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference faults mentioning xfs_bmapi_write or xfs_bmap_extents_to_btree; correlate with recent mount or filesystem operations on XFS volumes.

• xfs_bmapi_write
• xfs_bmap_extents_to_btree
• NULL pointer dereference
• xfs image

What your security team should do

• Patch all systems to a fixed kernel release as soon as possible
• Restrict untrusted XFS images from being mounted by unprivileged users
• Monitor kernel logs for xfs-related oops messages
• Review systems using XFS for any local-user attack surface