CVE-2023-53194 (GCVE-0-2023-53194)
Vulnerability from cvelistv5
Published
2025-09-15 14:06
Modified
2025-09-16 08:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Add length check in indx_get_root
This adds a length check to guarantee the retrieved index root is legit.
[ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320
[ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243
[ 162.460851]
[ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42
[ 162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 162.462609] Call Trace:
[ 162.462954] <TASK>
[ 162.463276] dump_stack_lvl+0x49/0x63
[ 162.463822] print_report.cold+0xf5/0x689
[ 162.464608] ? unwind_get_return_address+0x3a/0x60
[ 162.465766] ? hdr_find_e.isra.0+0x10c/0x320
[ 162.466975] kasan_report+0xa7/0x130
[ 162.467506] ? _raw_spin_lock_irq+0xc0/0xf0
[ 162.467998] ? hdr_find_e.isra.0+0x10c/0x320
[ 162.468536] __asan_load2+0x68/0x90
[ 162.468923] hdr_find_e.isra.0+0x10c/0x320
[ 162.469282] ? cmp_uints+0xe0/0xe0
[ 162.469557] ? cmp_sdh+0x90/0x90
[ 162.469864] ? ni_find_attr+0x214/0x300
[ 162.470217] ? ni_load_mi+0x80/0x80
[ 162.470479] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 162.470931] ? ntfs_bread_run+0x190/0x190
[ 162.471307] ? indx_get_root+0xe4/0x190
[ 162.471556] ? indx_get_root+0x140/0x190
[ 162.471833] ? indx_init+0x1e0/0x1e0
[ 162.472069] ? fnd_clear+0x115/0x140
[ 162.472363] ? _raw_spin_lock_irqsave+0x100/0x100
[ 162.472731] indx_find+0x184/0x470
[ 162.473461] ? sysvec_apic_timer_interrupt+0x57/0xc0
[ 162.474429] ? indx_find_buffer+0x2d0/0x2d0
[ 162.474704] ? do_syscall_64+0x3b/0x90
[ 162.474962] dir_search_u+0x196/0x2f0
[ 162.475381] ? ntfs_nls_to_utf16+0x450/0x450
[ 162.475661] ? ntfs_security_init+0x3d6/0x440
[ 162.475906] ? is_sd_valid+0x180/0x180
[ 162.476191] ntfs_extend_init+0x13f/0x2c0
[ 162.476496] ? ntfs_fix_post_read+0x130/0x130
[ 162.476861] ? iput.part.0+0x286/0x320
[ 162.477325] ntfs_fill_super+0x11e0/0x1b50
[ 162.477709] ? put_ntfs+0x1d0/0x1d0
[ 162.477970] ? vsprintf+0x20/0x20
[ 162.478258] ? set_blocksize+0x95/0x150
[ 162.478538] get_tree_bdev+0x232/0x370
[ 162.478789] ? put_ntfs+0x1d0/0x1d0
[ 162.479038] ntfs_fs_get_tree+0x15/0x20
[ 162.479374] vfs_get_tree+0x4c/0x130
[ 162.479729] path_mount+0x654/0xfe0
[ 162.480124] ? putname+0x80/0xa0
[ 162.480484] ? finish_automount+0x2e0/0x2e0
[ 162.480894] ? putname+0x80/0xa0
[ 162.481467] ? kmem_cache_free+0x1c4/0x440
[ 162.482280] ? putname+0x80/0xa0
[ 162.482714] do_mount+0xd6/0xf0
[ 162.483264] ? path_mount+0xfe0/0xfe0
[ 162.484782] ? __kasan_check_write+0x14/0x20
[ 162.485593] __x64_sys_mount+0xca/0x110
[ 162.486024] do_syscall_64+0x3b/0x90
[ 162.486543] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 162.487141] RIP: 0033:0x7f9d374e948a
[ 162.488324] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008
[ 162.489728] RSP: 002b:00007ffe30e73d18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
[ 162.490971] RAX: ffffffffffffffda RBX: 0000561cdb43a060 RCX: 00007f9d374e948a
[ 162.491669] RDX: 0000561cdb43a260 RSI: 0000561cdb43a2e0 RDI: 0000561cdb442af0
[ 162.492050] RBP: 0000000000000000 R08: 0000561cdb43a280 R09: 0000000000000020
[ 162.492459] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000561cdb442af0
[ 162.493183] R13: 0000561cdb43a260 R14: 0000000000000000 R15: 00000000ffffffff
[ 162.493644] </TASK>
[ 162.493908]
[ 162.494214] The buggy address belongs to the physical page:
[ 162.494761] page:000000003e38a3d5 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37bc
[ 162.496064] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
[ 162.497278] raw: 000fffffc0000000 ffffea00000df1c8 ffffea00000df008 0000000000000000
[ 162.498928] raw: 0000000000000000 0000000000240000 00000000ffffffff 0000000000000000
[ 162.500542] page dumped becau
---truncated---
References
Impacted products
{ "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/ntfs3/index.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "85afd3007465f8bc74afffbf5b84ec29f5310b03", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git" }, { "lessThan": "0d04e45c65f0785e558b93d2631d58680f263e10", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git" }, { "lessThan": "eb5b59931d20f3b02076fae49e85282310b12012", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git" }, { "lessThan": "08e8cf5f2d9ec383a2e339a2711b62a54ff3fba0", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/ntfs3/index.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.113", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.81", "versionType": "semver" }, { "lessThanOrEqual": "6.3.*", "status": "unaffected", "version": "6.3.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.4", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.15.113", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.81", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.3.4", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.4", "versionStartIncluding": "5.15", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add length check in indx_get_root\n\nThis adds a length check to guarantee the retrieved index root is legit.\n\n[ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320\n[ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243\n[ 162.460851]\n[ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42\n[ 162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 162.462609] Call Trace:\n[ 162.462954] \u003cTASK\u003e\n[ 162.463276] dump_stack_lvl+0x49/0x63\n[ 162.463822] print_report.cold+0xf5/0x689\n[ 162.464608] ? unwind_get_return_address+0x3a/0x60\n[ 162.465766] ? hdr_find_e.isra.0+0x10c/0x320\n[ 162.466975] kasan_report+0xa7/0x130\n[ 162.467506] ? _raw_spin_lock_irq+0xc0/0xf0\n[ 162.467998] ? hdr_find_e.isra.0+0x10c/0x320\n[ 162.468536] __asan_load2+0x68/0x90\n[ 162.468923] hdr_find_e.isra.0+0x10c/0x320\n[ 162.469282] ? cmp_uints+0xe0/0xe0\n[ 162.469557] ? cmp_sdh+0x90/0x90\n[ 162.469864] ? ni_find_attr+0x214/0x300\n[ 162.470217] ? ni_load_mi+0x80/0x80\n[ 162.470479] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 162.470931] ? ntfs_bread_run+0x190/0x190\n[ 162.471307] ? indx_get_root+0xe4/0x190\n[ 162.471556] ? indx_get_root+0x140/0x190\n[ 162.471833] ? indx_init+0x1e0/0x1e0\n[ 162.472069] ? fnd_clear+0x115/0x140\n[ 162.472363] ? _raw_spin_lock_irqsave+0x100/0x100\n[ 162.472731] indx_find+0x184/0x470\n[ 162.473461] ? sysvec_apic_timer_interrupt+0x57/0xc0\n[ 162.474429] ? indx_find_buffer+0x2d0/0x2d0\n[ 162.474704] ? do_syscall_64+0x3b/0x90\n[ 162.474962] dir_search_u+0x196/0x2f0\n[ 162.475381] ? ntfs_nls_to_utf16+0x450/0x450\n[ 162.475661] ? ntfs_security_init+0x3d6/0x440\n[ 162.475906] ? is_sd_valid+0x180/0x180\n[ 162.476191] ntfs_extend_init+0x13f/0x2c0\n[ 162.476496] ? ntfs_fix_post_read+0x130/0x130\n[ 162.476861] ? iput.part.0+0x286/0x320\n[ 162.477325] ntfs_fill_super+0x11e0/0x1b50\n[ 162.477709] ? put_ntfs+0x1d0/0x1d0\n[ 162.477970] ? vsprintf+0x20/0x20\n[ 162.478258] ? set_blocksize+0x95/0x150\n[ 162.478538] get_tree_bdev+0x232/0x370\n[ 162.478789] ? put_ntfs+0x1d0/0x1d0\n[ 162.479038] ntfs_fs_get_tree+0x15/0x20\n[ 162.479374] vfs_get_tree+0x4c/0x130\n[ 162.479729] path_mount+0x654/0xfe0\n[ 162.480124] ? putname+0x80/0xa0\n[ 162.480484] ? finish_automount+0x2e0/0x2e0\n[ 162.480894] ? putname+0x80/0xa0\n[ 162.481467] ? kmem_cache_free+0x1c4/0x440\n[ 162.482280] ? putname+0x80/0xa0\n[ 162.482714] do_mount+0xd6/0xf0\n[ 162.483264] ? path_mount+0xfe0/0xfe0\n[ 162.484782] ? __kasan_check_write+0x14/0x20\n[ 162.485593] __x64_sys_mount+0xca/0x110\n[ 162.486024] do_syscall_64+0x3b/0x90\n[ 162.486543] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 162.487141] RIP: 0033:0x7f9d374e948a\n[ 162.488324] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 162.489728] RSP: 002b:00007ffe30e73d18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5\n[ 162.490971] RAX: ffffffffffffffda RBX: 0000561cdb43a060 RCX: 00007f9d374e948a\n[ 162.491669] RDX: 0000561cdb43a260 RSI: 0000561cdb43a2e0 RDI: 0000561cdb442af0\n[ 162.492050] RBP: 0000000000000000 R08: 0000561cdb43a280 R09: 0000000000000020\n[ 162.492459] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000561cdb442af0\n[ 162.493183] R13: 0000561cdb43a260 R14: 0000000000000000 R15: 00000000ffffffff\n[ 162.493644] \u003c/TASK\u003e\n[ 162.493908]\n[ 162.494214] The buggy address belongs to the physical page:\n[ 162.494761] page:000000003e38a3d5 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37bc\n[ 162.496064] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n[ 162.497278] raw: 000fffffc0000000 ffffea00000df1c8 ffffea00000df008 0000000000000000\n[ 162.498928] raw: 0000000000000000 0000000000240000 00000000ffffffff 0000000000000000\n[ 162.500542] page dumped becau\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2025-09-16T08:02:23.422Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/85afd3007465f8bc74afffbf5b84ec29f5310b03" }, { "url": "https://git.kernel.org/stable/c/0d04e45c65f0785e558b93d2631d58680f263e10" }, { "url": "https://git.kernel.org/stable/c/eb5b59931d20f3b02076fae49e85282310b12012" }, { "url": "https://git.kernel.org/stable/c/08e8cf5f2d9ec383a2e339a2711b62a54ff3fba0" } ], "title": "fs/ntfs3: Add length check in indx_get_root", "x_generator": { "engine": "bippy-1.2.0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-53194", "datePublished": "2025-09-15T14:06:41.076Z", "dateReserved": "2025-09-15T13:59:19.067Z", "dateUpdated": "2025-09-16T08:02:23.422Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-53194\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:41.763\",\"lastModified\":\"2025-09-15T15:22:27.090\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/ntfs3: Add length check in indx_get_root\\n\\nThis adds a length check to guarantee the retrieved index root is legit.\\n\\n[ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320\\n[ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243\\n[ 162.460851]\\n[ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42\\n[ 162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\\n[ 162.462609] Call Trace:\\n[ 162.462954] \u003cTASK\u003e\\n[ 162.463276] dump_stack_lvl+0x49/0x63\\n[ 162.463822] print_report.cold+0xf5/0x689\\n[ 162.464608] ? unwind_get_return_address+0x3a/0x60\\n[ 162.465766] ? hdr_find_e.isra.0+0x10c/0x320\\n[ 162.466975] kasan_report+0xa7/0x130\\n[ 162.467506] ? _raw_spin_lock_irq+0xc0/0xf0\\n[ 162.467998] ? hdr_find_e.isra.0+0x10c/0x320\\n[ 162.468536] __asan_load2+0x68/0x90\\n[ 162.468923] hdr_find_e.isra.0+0x10c/0x320\\n[ 162.469282] ? cmp_uints+0xe0/0xe0\\n[ 162.469557] ? cmp_sdh+0x90/0x90\\n[ 162.469864] ? ni_find_attr+0x214/0x300\\n[ 162.470217] ? ni_load_mi+0x80/0x80\\n[ 162.470479] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n[ 162.470931] ? ntfs_bread_run+0x190/0x190\\n[ 162.471307] ? indx_get_root+0xe4/0x190\\n[ 162.471556] ? indx_get_root+0x140/0x190\\n[ 162.471833] ? indx_init+0x1e0/0x1e0\\n[ 162.472069] ? fnd_clear+0x115/0x140\\n[ 162.472363] ? _raw_spin_lock_irqsave+0x100/0x100\\n[ 162.472731] indx_find+0x184/0x470\\n[ 162.473461] ? sysvec_apic_timer_interrupt+0x57/0xc0\\n[ 162.474429] ? indx_find_buffer+0x2d0/0x2d0\\n[ 162.474704] ? do_syscall_64+0x3b/0x90\\n[ 162.474962] dir_search_u+0x196/0x2f0\\n[ 162.475381] ? ntfs_nls_to_utf16+0x450/0x450\\n[ 162.475661] ? ntfs_security_init+0x3d6/0x440\\n[ 162.475906] ? is_sd_valid+0x180/0x180\\n[ 162.476191] ntfs_extend_init+0x13f/0x2c0\\n[ 162.476496] ? ntfs_fix_post_read+0x130/0x130\\n[ 162.476861] ? iput.part.0+0x286/0x320\\n[ 162.477325] ntfs_fill_super+0x11e0/0x1b50\\n[ 162.477709] ? put_ntfs+0x1d0/0x1d0\\n[ 162.477970] ? vsprintf+0x20/0x20\\n[ 162.478258] ? set_blocksize+0x95/0x150\\n[ 162.478538] get_tree_bdev+0x232/0x370\\n[ 162.478789] ? put_ntfs+0x1d0/0x1d0\\n[ 162.479038] ntfs_fs_get_tree+0x15/0x20\\n[ 162.479374] vfs_get_tree+0x4c/0x130\\n[ 162.479729] path_mount+0x654/0xfe0\\n[ 162.480124] ? putname+0x80/0xa0\\n[ 162.480484] ? finish_automount+0x2e0/0x2e0\\n[ 162.480894] ? putname+0x80/0xa0\\n[ 162.481467] ? kmem_cache_free+0x1c4/0x440\\n[ 162.482280] ? putname+0x80/0xa0\\n[ 162.482714] do_mount+0xd6/0xf0\\n[ 162.483264] ? path_mount+0xfe0/0xfe0\\n[ 162.484782] ? __kasan_check_write+0x14/0x20\\n[ 162.485593] __x64_sys_mount+0xca/0x110\\n[ 162.486024] do_syscall_64+0x3b/0x90\\n[ 162.486543] entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n[ 162.487141] RIP: 0033:0x7f9d374e948a\\n[ 162.488324] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\\n[ 162.489728] RSP: 002b:00007ffe30e73d18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5\\n[ 162.490971] RAX: ffffffffffffffda RBX: 0000561cdb43a060 RCX: 00007f9d374e948a\\n[ 162.491669] RDX: 0000561cdb43a260 RSI: 0000561cdb43a2e0 RDI: 0000561cdb442af0\\n[ 162.492050] RBP: 0000000000000000 R08: 0000561cdb43a280 R09: 0000000000000020\\n[ 162.492459] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000561cdb442af0\\n[ 162.493183] R13: 0000561cdb43a260 R14: 0000000000000000 R15: 00000000ffffffff\\n[ 162.493644] \u003c/TASK\u003e\\n[ 162.493908]\\n[ 162.494214] The buggy address belongs to the physical page:\\n[ 162.494761] page:000000003e38a3d5 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37bc\\n[ 162.496064] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\\n[ 162.497278] raw: 000fffffc0000000 ffffea00000df1c8 ffffea00000df008 0000000000000000\\n[ 162.498928] raw: 0000000000000000 0000000000240000 00000000ffffffff 0000000000000000\\n[ 162.500542] page dumped becau\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08e8cf5f2d9ec383a2e339a2711b62a54ff3fba0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0d04e45c65f0785e558b93d2631d58680f263e10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/85afd3007465f8bc74afffbf5b84ec29f5310b03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb5b59931d20f3b02076fae49e85282310b12012\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…