CVE-2020-27815

What it actually does

The flaw in JFS extended attribute handling triggers memory corruption in the Linux kernel, enabling local attackers to induce kernel panics or achieve privilege escalation.

Why it matters to the business

Local attackers can crash affected Linux systems or gain elevated privileges, leading to downtime, data integrity loss, and potential full system compromise on servers or endpoints using the JFS filesystem.

How an attack unfolds

A local attacker with the ability to set extended attributes crafts malicious xattr values on JFS objects; the kernel mishandles the input, corrupting memory structures and allowing either denial of service via panic or escalation to root privileges. Public exploits are available.

How to fix it

Upgrade the Linux kernel to the fixed commit c61b3e4839007668360ed8b87d7da96d2e59fc6c; rebuild and reboot with the patched kernel. Where immediate patching is impossible, restrict untrusted local accounts and avoid JFS mounts.

How to confirm the fix worked

Confirm the running kernel contains commit c61b3e4839007668360ed8b87d7da96d2e59fc6c, then attempt setfattr operations on JFS and verify absence of panics or corruption.

Typical attack path

1. Obtain local shell access on a target Linux system
2. Identify or create a JFS filesystem mount point
3. Use setfattr or equivalent to apply crafted extended attributes
4. Trigger the corruption path to induce panic or escalate privileges

How to detect it

Review kernel logs for JFS-related oops or panic messages mentioning extended attributes; examine audit logs for unusual setfattr activity on JFS volumes.

• jfs_xattr
• kernel: JFS: panic
• EXT4-fs error.*xattr

What your security team should do

• Prioritize kernel upgrade across all JFS-using systems within standard maintenance windows
• Audit local user permissions and limit ability to set extended attributes
• Enable kernel hardening features such as lockdown mode where feasible