CVE-2019-5094
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Risk Assessment
The risk to the organization includes the possibility of remote code execution by an attacker who can deliver a crafted partition, potentially leading to system compromise or data corruption.
Recommendation
It is recommended to immediately update E2fsprogs to a patched version and avoid mounting untrusted ext4 partitions.
Other vulnerabilities in E2fsprogs
See all- CVE-2022-1304High
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.
- CVE-2026-45531High
In the read_boot_region function of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2019-5188High
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Original NVD description (English source)
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS