CVE-2021-3428: Linux Kernel ext4 DoS Vulnerability

CVE-2021-3428 Overview

CVE-2021-3428 is an integer overflow vulnerability [CWE-190] in the Linux kernel's ext4 filesystem implementation. The flaw resides in the ext4_es_cache_extent function within fs/ext4/extents.c. A local attacker with limited user privileges can trigger the issue by mounting a crafted ext4 filesystem containing a corrupted extent tree. Successful exploitation causes a kernel crash, resulting in denial of service and degraded system availability.

Critical Impact
A local user with privileges to mount a crafted filesystem can fabricate an integer overflow inside the ext4 extent caching path, crashing the kernel and impacting availability of the affected host.

Affected Products

Linux Kernel (upstream)
Red Hat Enterprise Linux distributions referencing Bugzilla #1972621
Ubuntu distributions tracking CVE-2021-3428

Discovery Timeline

2021-03-17 - Vulnerability publicly discussed on the OpenWall oss-security mailing list
2022-03-04 - CVE-2021-3428 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2021-3428

Vulnerability Analysis

The vulnerability resides in the Linux kernel ext4 filesystem driver, specifically in the extent status tree caching logic implemented in fs/ext4/extents.c. The ext4_es_cache_extent function caches extent tree entries to accelerate block mapping lookups during filesystem operations. When the kernel parses a maliciously crafted ext4 filesystem image, corrupted extent metadata can lead to arithmetic operations producing values that exceed expected integer bounds.

The integer overflow [CWE-190] causes the kernel to operate on invalid extent ranges. Subsequent code paths dereference or compute offsets based on the overflowed value, triggering a kernel panic or BUG_ON condition. The result is a denial-of-service condition that halts the affected system.

Exploitation requires local access and the ability to mount a crafted filesystem image. This typically requires either an account with mount privileges, access to a setuid mount helper, or the ability to attach removable media that the system auto-mounts. The flaw does not yield code execution or data disclosure, only an availability impact.

Root Cause

The root cause is missing validation of extent tree fields read from an untrusted on-disk filesystem structure. The ext4 driver assumes that block counts and logical offsets honor the filesystem's documented constraints. A corrupted extent header or entry can supply values that, when combined arithmetically inside ext4_es_cache_extent, overflow signed or unsigned integer limits before bounds checks are applied.

Attack Vector

The attack vector is local. An attacker prepares an ext4 image with a deliberately corrupted extent tree and induces the kernel to mount or operate on the image. Triggering the vulnerable code path requires filesystem operations that consult the extent status tree, such as reading file data or traversing directory entries. The vulnerability described in the bug report does not require network access or user interaction beyond the mount operation.

No public proof-of-concept or exploit code is associated with this CVE in the referenced advisories.

Detection Methods for CVE-2021-3428

Indicators of Compromise

Unexpected kernel panics or BUG messages referencing ext4_es_cache_extent or fs/ext4/extents.c in dmesg and /var/log/kern.log
Sudden host unavailability shortly after a mount operation on removable media or a user-supplied image file
Filesystem error events logged by the ext4 driver such as EXT4-fs error entries preceding a crash

Detection Strategies

Audit kernel ring buffer output for ext4 extent-related warnings and oops traces on hosts that accept user-supplied disk images
Monitor mount syscall activity from non-administrative users and flag mounts of loopback or removable ext4 volumes
Correlate unscheduled reboots with prior filesystem mount events to identify potential exploitation attempts

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on ext4 error signatures
Track which user accounts hold CAP_SYS_ADMIN or mount privileges and review any unexpected grants
Inspect auto-mount daemon activity such as udisks2 and systemd-udevd for mounts of unknown block devices

How to Mitigate CVE-2021-3428

Immediate Actions Required

Apply the kernel updates published by your Linux distribution vendor referencing CVE-2021-3428
Restrict mount privileges so untrusted local users cannot mount arbitrary ext4 images or removable media
Disable or constrain auto-mount services on multi-user systems and kiosks that handle untrusted media

Patch Information

Patches are tracked by upstream Linux distributions. Refer to the Red Hat Bug Report #1972621 and the Ubuntu Security CVE-2021-3428 advisory for distribution-specific fixed kernel versions. Additional technical discussion is available on the OpenWall OSS Security Discussion.

Workarounds

Remove the user and users mount options from /etc/fstab entries that allow non-root users to mount filesystems
Use mandatory access control policies such as SELinux or AppArmor to restrict which processes may invoke mount
Block loading of the ext4 module on systems that do not require it, using modprobe blacklist configuration

bash

# Configuration example: prevent unprivileged users from mounting filesystems
# Remove 'user' / 'users' options from /etc/fstab and confirm via:
grep -E 'user(s)?' /etc/fstab

# Restrict mount syscall via systemd unit hardening
# Add to service unit files handling untrusted input:
#   SystemCallFilter=~@mount
#   CapabilityBoundingSet=~CAP_SYS_ADMIN

# Verify installed kernel version contains the distribution fix
uname -r