CVE-2018-13093

What it actually does

NULL pointer dereference in XFS inode cache lookup path on a corrupted filesystem image, causing kernel panic during pathwalks due to missing validation of cached inodes.

Why it matters to the business

Local denial-of-service crashes on Linux systems using the XFS filesystem when processing untrusted or corrupted disk images, leading to unplanned downtime and potential loss of availability for file services.

How an attack unfolds

An attacker crafts a malicious XFS filesystem image containing invalid inode structures, then causes a local user or process to perform directory traversal or path lookup operations against the mounted image, triggering the missing validation and kernel panic.

How to fix it

Update the Linux kernel to include commit afca6c5b2595fc44383919fba740c194b0b76aff or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains the fix commit; attempt reproduction with a known trigger image in a test environment and confirm no panic occurs.

Typical attack path

1. Craft or obtain a corrupted XFS filesystem image with invalid inode cache entries
2. Mount the image or cause a local process to access paths within it
3. Trigger lookup_slow() during path resolution on the corrupted inode
4. Trigger NULL inode->i_ops dereference resulting in kernel panic

How to detect it

Review kernel logs for XFS inode cache NULL pointer dereference messages and oops traces during pathwalk operations; correlate with recent mounting of external or untrusted storage images.

• NULL pointer dereference in lookup_slow
• xfs_icache.c
• panic on corrupted xfs image

What your security team should do

• Prioritize patching XFS-enabled systems that handle untrusted images or external storage
• Apply the kernel update containing afca6c5b2595fc44383919fba740c194b0b76aff immediately
• Restrict mounting of untrusted XFS images until patched
• Monitor kernel logs for XFS-related oops and panics