CVE-2018-1092

What it actually does

The ext4_iget function mishandles a root directory with zero i_links_count in a crafted ext4 image, resulting in a NULL pointer dereference in ext4_process_freed_data and subsequent kernel OOPS/denial of service.

Why it matters to the business

Local denial of service can interrupt system availability when users process malicious filesystem images, leading to operational downtime; low exploit maturity and EPSS reduce immediate urgency despite the 2018 disclosure.

How an attack unfolds

An attacker prepares a specially crafted ext4 filesystem image with a root directory having i_links_count set to zero, then causes the target to mount or otherwise process the image locally, triggering the kernel NULL dereference and crash.

How to fix it

Upgrade affected packages to the fixed versions: haf/dotnetzip.semverd (GIT) fixed in 55d2c13c0cc64654e18fcdd0038fdb3d7458e366. Apply kernel updates that correctly handle zero i_links_count root directories.

How to confirm the fix worked

Verify the installed kernel or package version is at or above the fixed commit, attempt to mount test images with zero-link root directories in a controlled environment, and confirm no NULL dereference occurs.

Typical attack path

1. Craft malicious ext4 image with zero i_links_count root directory
2. Deliver the image to the target system via removable media or download
3. Trick or coerce local user into mounting or accessing the image
4. Kernel invokes ext4_iget on the malformed directory causing NULL dereference and OOPS

How to detect it

Review system logs for ext4_process_freed_data NULL pointer dereference and kernel OOPS entries around the time of suspected image access; monitor for unexpected system reboots or crashes when ext4 volumes are mounted.

What your security team should do

• Prioritize patching systems that routinely mount untrusted ext4 images
• Update to haf/dotnetzip.semverd (GIT) commit 55d2c13c0cc64654e18fcdd0038fdb3d7458e366 or later kernel releases
• Restrict mounting of external filesystems from untrusted sources until patched