CVE-2019-5188

What it actually does

The vulnerability is an out-of-bounds write on the stack in the directory rehashing functionality of e2fsck, triggered by a specially crafted ext4 directory entry, enabling arbitrary code execution.

Why it matters to the business

A local attacker with administrative access can corrupt an ext4 filesystem image to gain code execution on affected systems, potentially leading to full host compromise during filesystem checks or maintenance operations; the issue affects widely used storage tooling with no ransomware or broad exploitation observed.

How an attack unfolds

An attacker prepares a malicious ext4 partition containing a crafted directory structure, mounts or presents it to the target, and triggers e2fsck to process the directory rehashing code path, resulting in a stack-based write that redirects execution to attacker-controlled code.

How to fix it

Upgrade e2fsprogs to a version newer than 1.45.4; for the listed package, apply the fix at commit 311acbc4e7bd38fa3f3d0e158b35cde9ef73f8e5 or later equivalent release.

How to confirm the fix worked

Confirm e2fsprogs version is greater than 1.45.4, run e2fsck against known-good and test-crafted images to verify absence of the crash or write, and review package changelogs for the directory rehashing fixes.

Typical attack path

1. Obtain local administrative privileges on the target system
2. Craft or obtain a malicious ext4 filesystem image with a specially formatted directory
3. Cause e2fsck to run against the corrupted partition (e.g., during boot, fsck, or manual invocation)
4. Trigger the directory rehashing routine to perform the out-of-bounds stack write
5. Execute arbitrary code in the context of the e2fsck process

How to detect it

Review system logs for unexpected e2fsck crashes or segmentation faults during filesystem checks, inspect audit logs for invocations of e2fsck on untrusted or newly introduced partitions, and look for post-exploitation artifacts such as modified binaries or unexpected processes spawned from fsck contexts.

What your security team should do

• Prioritize patching e2fsprogs on all systems that perform ext4 filesystem checks
• Restrict local administrative access to reduce the attack surface for local privilege-escalation paths
• Monitor filesystem integrity tools for unexpected crashes or high-privilege process anomalies
• Include e2fsprogs in regular vulnerability scanning and patch management workflows