CVE-2023-53101 (GCVE-0-2023-53101)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2025-05-04 07:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0. However, if the "never before used" boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning: WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa RIP: 0010:ext4_file_write_iter+0xbc7/0xd10 Call Trace: vfs_write+0x3b1/0x5c0 ksys_write+0x77/0x160 __x64_sys_write+0x22/0x30 do_syscall_64+0x39/0x80 Reproducer: 1. create corrupted image and mount it: mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR "sif <5> size 25700" /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 > file 2. Run the reproducer program: posix_memalign(&buf, 1024, 1024) fd = open("file", O_RDWR | O_DIRECT); ioctl(fd, EXT4_IOC_SWAP_BOOT); write(fd, buf, 1024); Fix this by setting i_disksize as well as i_size to zero when initiaizing the boot loader inode.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/01a821aacc64d4b05dafd239dbc9b7856686002f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d8a6c9a6415999fee1259ccf1796480c026b7d6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3f00c476da8fe7c4c34ea16abb55d74127120413
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/59eee0cdf8c036f554add97a4da7c06d7a9ff34a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9cb27b1e76f0cc886ac09055bc41c0ab3f205167
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9e9a4cc5486356158554f6ad73027d8635a48b34
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d6c1447e483c05dbcfb3ff77ac04237a82070b8c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f5361da1e60d54ec81346aee8e3d8baf1be0b762
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6c1447e483c05dbcfb3ff77ac04237a82070b8c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "59eee0cdf8c036f554add97a4da7c06d7a9ff34a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0d8a6c9a6415999fee1259ccf1796480c026b7d6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3f00c476da8fe7c4c34ea16abb55d74127120413",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "01a821aacc64d4b05dafd239dbc9b7856686002f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9cb27b1e76f0cc886ac09055bc41c0ab3f205167",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9e9a4cc5486356158554f6ad73027d8635a48b34",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f5361da1e60d54ec81346aee8e3d8baf1be0b762",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.310",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.310",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.278",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.237",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: zero i_disksize when initializing the bootloader inode\n\nIf the boot loader inode has never been used before, the\nEXT4_IOC_SWAP_BOOT inode will initialize it, including setting the\ni_size to 0.  However, if the \"never before used\" boot loader has a\nnon-zero i_size, then i_disksize will be non-zero, and the\ninconsistency between i_size and i_disksize can trigger a kernel\nwarning:\n\n WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319\n CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa\n RIP: 0010:ext4_file_write_iter+0xbc7/0xd10\n Call Trace:\n  vfs_write+0x3b1/0x5c0\n  ksys_write+0x77/0x160\n  __x64_sys_write+0x22/0x30\n  do_syscall_64+0x39/0x80\n\nReproducer:\n 1. create corrupted image and mount it:\n       mke2fs -t ext4 /tmp/foo.img 200\n       debugfs -wR \"sif \u003c5\u003e size 25700\" /tmp/foo.img\n       mount -t ext4 /tmp/foo.img /mnt\n       cd /mnt\n       echo 123 \u003e file\n 2. Run the reproducer program:\n       posix_memalign(\u0026buf, 1024, 1024)\n       fd = open(\"file\", O_RDWR | O_DIRECT);\n       ioctl(fd, EXT4_IOC_SWAP_BOOT);\n       write(fd, buf, 1024);\n\nFix this by setting i_disksize as well as i_size to zero when\ninitiaizing the boot loader inode."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:49:52.100Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6c1447e483c05dbcfb3ff77ac04237a82070b8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/59eee0cdf8c036f554add97a4da7c06d7a9ff34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d8a6c9a6415999fee1259ccf1796480c026b7d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f00c476da8fe7c4c34ea16abb55d74127120413"
        },
        {
          "url": "https://git.kernel.org/stable/c/01a821aacc64d4b05dafd239dbc9b7856686002f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cb27b1e76f0cc886ac09055bc41c0ab3f205167"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e9a4cc5486356158554f6ad73027d8635a48b34"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5361da1e60d54ec81346aee8e3d8baf1be0b762"
        }
      ],
      "title": "ext4: zero i_disksize when initializing the bootloader inode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53101",
    "datePublished": "2025-05-02T15:55:43.804Z",
    "dateReserved": "2025-05-02T15:51:43.553Z",
    "dateUpdated": "2025-05-04T07:49:52.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53101\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:29.023\",\"lastModified\":\"2025-05-05T20:54:45.973\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: zero i_disksize when initializing the bootloader inode\\n\\nIf the boot loader inode has never been used before, the\\nEXT4_IOC_SWAP_BOOT inode will initialize it, including setting the\\ni_size to 0.  However, if the \\\"never before used\\\" boot loader has a\\nnon-zero i_size, then i_disksize will be non-zero, and the\\ninconsistency between i_size and i_disksize can trigger a kernel\\nwarning:\\n\\n WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319\\n CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa\\n RIP: 0010:ext4_file_write_iter+0xbc7/0xd10\\n Call Trace:\\n  vfs_write+0x3b1/0x5c0\\n  ksys_write+0x77/0x160\\n  __x64_sys_write+0x22/0x30\\n  do_syscall_64+0x39/0x80\\n\\nReproducer:\\n 1. create corrupted image and mount it:\\n       mke2fs -t ext4 /tmp/foo.img 200\\n       debugfs -wR \\\"sif \u003c5\u003e size 25700\\\" /tmp/foo.img\\n       mount -t ext4 /tmp/foo.img /mnt\\n       cd /mnt\\n       echo 123 \u003e file\\n 2. Run the reproducer program:\\n       posix_memalign(\u0026buf, 1024, 1024)\\n       fd = open(\\\"file\\\", O_RDWR | O_DIRECT);\\n       ioctl(fd, EXT4_IOC_SWAP_BOOT);\\n       write(fd, buf, 1024);\\n\\nFix this by setting i_disksize as well as i_size to zero when\\ninitiaizing the boot loader inode.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: i_disksize cero al inicializar el inodo del cargador de arranque. Si el inodo del cargador de arranque nunca se ha usado antes, el inodo EXT4_IOC_SWAP_BOOT lo inicializar\u00e1, incluyendo el establecimiento de i_size a 0. Sin embargo, si el cargador de arranque \\\"nunca usado antes\\\" tiene un i_size distinto de cero, entonces i_disksize ser\u00e1 distinto de cero, y la inconsistencia entre i_size e i_disksize puede activar una advertencia del kernel: ADVERTENCIA: CPU: 0 PID: 2580 en fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb No contaminado 6.3.0-rc1-00004-g703695902cfa RIP: 0010:ext4_file_write_iter+0xbc7/0xd10 Rastreo de llamadas: vfs_write+0x3b1/0x5c0 ksys_write+0x77/0x160 __x64_sys_write+0x22/0x30 do_syscall_64+0x39/0x80 Reproductor: 1. crear una imagen da\u00f1ada y montarla: mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR \\\"sif \u0026lt;5\u0026gt; size 25700\\\" /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 \u0026gt; file 2. Ejecutar el programa reproductor: posix_memalign(\u0026amp;buf, 1024, 1024) fd = open(\\\"file\\\", O_RDWR | Solucione esto configurando i_disksize e i_size en cero al iniciar el inodo del cargador de arranque.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01a821aacc64d4b05dafd239dbc9b7856686002f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0d8a6c9a6415999fee1259ccf1796480c026b7d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f00c476da8fe7c4c34ea16abb55d74127120413\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59eee0cdf8c036f554add97a4da7c06d7a9ff34a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cb27b1e76f0cc886ac09055bc41c0ab3f205167\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e9a4cc5486356158554f6ad73027d8635a48b34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d6c1447e483c05dbcfb3ff77ac04237a82070b8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5361da1e60d54ec81346aee8e3d8baf1be0b762\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.