CVE-2020-12655

What it actually does

The vulnerability in xfs_agf_verify allows a locally mounted XFS v5 filesystem image containing crafted metadata to force the kernel into an allocation verification path that initiates a sync operation of unbounded duration, exhausting CPU or blocking I/O and resulting in denial of service.

Why it matters to the business

Systems relying on XFS may experience prolonged unavailability or complete hangs during routine filesystem operations when a malicious image is introduced, leading to service disruption, delayed recovery, and potential data-processing interruptions.

How an attack unfolds

An attacker with local access prepares an XFS v5 image whose allocation-group free-space metadata triggers excessive work in xfs_agf_verify, mounts the image, and performs operations that invoke allocation or sync paths, causing the kernel to block for an extended period.

How to fix it

Upgrade the kernel to a version containing commit d0c7feaf87678371c2c09b3709400be416b2dc62 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel source tree includes commit d0c7feaf87678371c2c09b3709400be416b2dc62; attempt to mount and exercise a test image that previously triggered the issue and verify that sync operations complete promptly.

Typical attack path

1. Obtain local user access on a system running a vulnerable kernel with XFS support
2. Craft or obtain an XFS v5 filesystem image containing malicious allocation-group metadata
3. Mount the image or trigger filesystem operations that reach xfs_agf_verify
4. Initiate allocation or sync activity to force the excessive-duration operation

How to detect it

Inspect kernel logs and audit records for unusually long XFS sync or allocation stalls; correlate with unexpected XFS image mounts by non-administrative users.

What your security team should do

• Apply the kernel update containing commit d0c7feaf87678371c2c09b3709400be416b2dc62 as soon as possible
• Restrict untrusted local users from mounting arbitrary filesystem images
• Review and harden XFS mount policies in multi-tenant or container environments