CVE-2020-14385: Linux Kernel XFS DoS Vulnerability

CVE-2020-14385 Overview

A flaw was found in the Linux kernel before version 5.9-rc4 affecting the XFS file system metadata validator. The vulnerability causes the validator to incorrectly flag inodes with valid, user-creatable extended attributes as corrupt. This misidentification can trigger a file system shutdown or render the file system inaccessible until remounted, resulting in a denial of service condition. The primary threat posed by this vulnerability is to system availability.

Critical Impact

Local users can cause XFS file system shutdown by creating specific extended attributes, leading to denial of service and system unavailability until manual intervention.

Affected Products

• Linux Kernel versions before 5.9-rc4 (including 5.9.0-rc1, 5.9.0-rc2, 5.9.0-rc3)
• Canonical Ubuntu Linux 18.04 LTS and 20.04 LTS
• Debian Linux 9.0

Discovery Timeline

• 2020-09-15 - CVE-2020-14385 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-14385

Vulnerability Analysis

This vulnerability resides in the XFS file system's metadata validation logic within the Linux kernel. The XFS file system includes built-in validators that check the integrity of file system metadata, including inode extended attributes. Due to a flaw in the validation logic, the validator incorrectly identifies certain valid extended attributes as corrupt when they are actually legitimate and user-creatable.

When an inode is flagged as corrupt, the XFS file system triggers protective measures that can include shutting down the file system entirely or making it read-only. This behavior, while intended to protect against actual corruption, becomes exploitable when the validator produces false positives. A local user with the ability to create extended attributes on an XFS file system can craft attributes that trigger this erroneous corruption detection, leading to a denial of service.

The vulnerability is classified under CWE-131 (Incorrect Calculation of Buffer Size), indicating that the root cause involves improper size calculations or boundary checks within the metadata validation code.

Root Cause

The root cause stems from an incorrect calculation in the XFS extended attribute metadata validator. The validator performs boundary and size checks on extended attribute metadata, but the calculation logic contains a flaw that causes valid extended attribute configurations to fail validation. Specifically, when user-creatable extended attributes reach certain size thresholds or configurations, the validator's size calculation produces incorrect results, triggering false corruption alerts.

This type of bug is particularly insidious because it affects legitimate file system operations rather than requiring malformed or malicious data. Normal user operations that create extended attributes within their permitted scope can inadvertently trigger the vulnerability.

Attack Vector

The attack requires local access to the system with sufficient privileges to create extended attributes on an XFS file system. An attacker can exploit this vulnerability by:

1. Identifying an XFS-mounted file system on the target system
2. Creating files or directories with specific extended attribute configurations
3. Triggering the metadata validator to check the crafted inode
4. Observing the file system shutdown or transition to read-only mode

The fix for this vulnerability was committed to the Linux kernel with commit hash f4020438fab05364018c91f7e02ebdd192085933. The patch corrects the buffer size calculation in the XFS metadata validator to properly handle valid extended attribute configurations without false positive corruption detection. For technical details on the specific changes, refer to the Linux Kernel Commit f4020438.

Detection Methods for CVE-2020-14385

Indicators of Compromise

• Unexpected XFS file system shutdowns or transitions to read-only mode
• Kernel log messages indicating inode corruption on XFS volumes
• System logs showing XFS: Corruption detected or similar metadata validation failures
• Repeated file system remount requirements without obvious disk issues

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for XFS corruption messages that appear without corresponding hardware errors
• Implement file system monitoring to detect unexpected state changes on XFS mounts
• Track extended attribute creation operations using auditd rules on XFS file systems
• Cross-reference file system errors with hardware diagnostics to identify false positive corruption events

Monitoring Recommendations

• Configure alerting for XFS metadata validation errors in centralized logging systems
• Enable Linux audit rules to track setxattr system calls on critical XFS volumes
• Monitor for patterns of repeated file system remounts indicating potential exploitation
• Implement baseline monitoring for extended attribute activity to detect anomalous patterns

How to Mitigate CVE-2020-14385

Immediate Actions Required

• Update the Linux kernel to version 5.9-rc4 or later where the vulnerability is patched
• Apply distribution-specific security updates from Ubuntu, Debian, or openSUSE security advisories
• Consider temporarily restricting extended attribute creation permissions on XFS file systems for untrusted users
• Implement monitoring for XFS file system health to detect any exploitation attempts

Patch Information

The vulnerability has been addressed in Linux kernel version 5.9-rc4 and later. The fix is available in the official kernel commit f4020438fab05364018c91f7e02ebdd192085933. Distribution vendors have released security updates:

• Ubuntu: Ubuntu Security Notice USN-4576-1
• Debian: Debian LTS Security Announcement
• openSUSE: openSUSE Security Announcement

For detailed bug tracking information, refer to the Red Hat Bug Report: CVE-2020-14385.

Workarounds

• Restrict access to XFS file systems for untrusted local users to limit exposure
• Consider using alternative file systems (ext4, btrfs) for volumes where untrusted users require extended attribute access
• Implement quotas and access controls to limit which users can create extended attributes
• Configure automatic file system recovery mechanisms to reduce downtime from unexpected shutdowns

# Configuration example: Restrict extended attribute capabilities for unprivileged users
# Add audit rule to monitor extended attribute operations on XFS mounts
auditctl -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -F key=xattr_monitor

# Check current kernel version for vulnerability status
uname -r

# Verify XFS mounts on the system
mount | grep xfs

# Apply security updates on Debian/Ubuntu systems
apt update && apt upgrade linux-image-$(uname -r)