CVE-2020-14314

What it actually does

Out-of-bounds memory read in ext3/ext4 directory indexing code that dereferences invalid structures, resulting in a kernel panic and denial of service.

Why it matters to the business

Local users can trigger repeated system crashes on affected Linux kernels, causing unplanned downtime and loss of availability for workloads that rely on the file system.

How an attack unfolds

An attacker with local shell access prepares or locates a directory whose on-disk index is malformed, then performs a directory operation that triggers the broken indexing path in ext3/ext4, causing the kernel to read outside allocated memory and panic the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 5872331b3d91820e14716632ebb56b1399b34fe1 or later; rebuild and reboot into the fixed kernel. Where live patching is available, apply the vendor's live kernel patch if offered.

How to confirm the fix worked

Confirm the running kernel commit or version is at or after 5872331b3d91820e14716632ebb56b1399b34fe1; attempt to reproduce the crash with a crafted directory on a test system before and after the update to verify the fix.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Create or discover a directory with intentionally corrupted index structures
3. Perform file-system operations (open, readdir, etc.) against the malformed directory
4. Trigger the out-of-bounds read and induce a kernel panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages that mention ext3, ext4, or directory indexing errors; correlate with user activity creating or accessing unusual directories immediately prior to the crash.

What your security team should do

• Prioritize kernel updates on all systems using ext3 or ext4 file systems
• Restrict local user creation of arbitrary directories on production systems until patched
• Monitor for kernel oops/panic events referencing ext4 directory code
• Review and apply the fixed commit across all downstream distributions and embedded devices