ghsa-f2h8-669r-j5fx
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds
Commit 56124d6c87fd ("fsverity: support enabling with tree block size < PAGE_SIZE") changed FS_IOC_ENABLE_VERITY to use __kernel_read() to read the file's data, instead of direct pagecache accesses.
An unintended consequence of this is that the 'WARN_ON_ONCE(!(file->f_mode & FMODE_READ))' in __kernel_read() became reachable by fuzz tests. This happens if FS_IOC_ENABLE_VERITY is called on a fd opened with access mode 3, which means "ioctl access only".
Arguably, FS_IOC_ENABLE_VERITY should work on ioctl-only fds. But ioctl-only fds are a weird Linux extension that is rarely used and that few people even know about. (The documentation for FS_IOC_ENABLE_VERITY even specifically says it requires O_RDONLY.) It's probably not worthwhile to make the ioctl internally open a new fd just to handle this case. Thus, just reject the ioctl on such fds for now.
{
"affected": [],
"aliases": [
"CVE-2023-53172"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T14:15:39Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds\n\nCommit 56124d6c87fd (\"fsverity: support enabling with tree block size \u003c\nPAGE_SIZE\") changed FS_IOC_ENABLE_VERITY to use __kernel_read() to read\nthe file\u0027s data, instead of direct pagecache accesses.\n\nAn unintended consequence of this is that the\n\u0027WARN_ON_ONCE(!(file-\u003ef_mode \u0026 FMODE_READ))\u0027 in __kernel_read() became\nreachable by fuzz tests. This happens if FS_IOC_ENABLE_VERITY is called\non a fd opened with access mode 3, which means \"ioctl access only\".\n\nArguably, FS_IOC_ENABLE_VERITY should work on ioctl-only fds. But\nioctl-only fds are a weird Linux extension that is rarely used and that\nfew people even know about. (The documentation for FS_IOC_ENABLE_VERITY\neven specifically says it requires O_RDONLY.) It\u0027s probably not\nworthwhile to make the ioctl internally open a new fd just to handle\nthis case. Thus, just reject the ioctl on such fds for now.",
"id": "GHSA-f2h8-669r-j5fx",
"modified": "2025-09-15T15:31:23Z",
"published": "2025-09-15T15:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53172"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/04839139213cf60d4c5fc792214a08830e294ff8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/85c039cff3c359967cafe90443c02321e950b216"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.