CVE-2015-1572

Vulnerability

A heap-based buffer overflow exists in the closefs.c file of the libext2fs library in e2fsprogs before version 1.42.12. The flaw occurs when a specially crafted block group descriptor is marked as dirty, due to an incomplete fix for CVE-2015-0247 [1][2]. Affected versions include those in Ubuntu and Mageia Linux distributions [1][2].

Exploitation

An attacker with local access can exploit this vulnerability by providing a maliciously crafted filesystem image that causes a boundary check error on block group descriptor data [1][2]. No special privileges are required beyond the ability to have the filesystem image processed by e2fsprogs utilities [1][2].

Impact

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the user running the affected utility, potentially leading to full system compromise if run as root [1][2]. The vulnerability enables arbitrary code execution through a heap buffer overflow [2].

Mitigation

Updates are available in e2fsprogs version 1.42.12 and later [1][2]. Ubuntu released fixed packages in USN-2507-1 on 23 February 2015 [1]. Mageia published updated packages (version 1.42.9-2.2.mga4 for Mageia 4) on 26 February 2015 [2]. Red Hat and Fedora advisories also addressed the issue [3][4].