CVE-2018-13095

What it actually does

The flaw triggers memory corruption and a kernel BUG when an XFS inode in extent format claims more extents than the inode fork can hold, occurring while parsing a corrupted filesystem image.

Why it matters to the business

Systems using the XFS filesystem can experience unexpected crashes or denial of service when a malicious or corrupted image is encountered, leading to operational disruption and potential data unavailability until reboot.

How an attack unfolds

An attacker crafts or obtains a corrupted XFS image containing an inode with an oversized extent count, then causes the target kernel to process the image through mount or file access operations, resulting in the crash condition.

How to fix it

Upgrade the Linux kernel to a version containing commit 23fcb3340d033d9f081e21e6c12c2db7eaa541d3 or later; apply the patch from the mainline repository and rebuild or install the updated kernel package.

How to confirm the fix worked

Verify the running kernel contains commit 23fcb3340d033d9f081e21e6c12c2db7eaa541d3 via git log or version string; test with a crafted XFS image containing an over-limit extent inode to confirm the BUG no longer occurs.

Typical attack path

1. Obtain or generate a malformed XFS filesystem image with an inode exceeding extent limits
2. Place the image on media accessible to the target system
3. Induce the kernel to read or mount the image via local user action
4. Trigger extent-format inode parsing in xfs_inode_buf.c
5. Cause memory corruption and BUG invocation leading to denial of service

How to detect it

Inspect kernel logs for oops or BUG messages originating from xfs_inode_buf.c during XFS operations; review audit or mount logs for recent access to suspicious XFS volumes.

What your security team should do

• Prioritize kernel updates on all systems using XFS filesystems
• Restrict untrusted XFS image handling to isolated environments until patched
• Monitor for kernel oops or BUG reports related to xfs_inode_buf
• Audit systems for exposure to external or user-supplied filesystem images