CVE-2023-52900
published 2024-08-21CVE-2023-52900: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
15.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfs_btree_insert()
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node
block by calling __nilfs_btree_get_block() against an invalid virtual
block address, it returns -ENOENT because conversion of the virtual block
address to a disk block address fails. However, this return value is the
same as the internal code that b-tree lookup routines return to indicate
that the block being searched does not exist, so functions that operate on
that b-tree may misbehave.
When nilfs_btree_insert() receives this spurious 'not found' code from
nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was
successful and continues the insert operation using incomplete lookup path
data, causing the following crash:
general protection fault, probably for non-canonical address
0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
...
RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline]
RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline]
RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238
Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89
ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 80 3c
28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02
...
Call Trace:
nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline]
nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147
nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101
__block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991
__block_write_begin fs/buffer.c:2041 [inline]
block_write_begin+0x93/0x1e0 fs/buffer.c:2102
nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261
generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772
__generic_file_write_iter+0x176/0x400 mm/filemap.c:3900
generic_file_write_iter+0xab/0x310 mm/filemap.c:3932
call_write_iter include/linux/fs.h:218
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.8-1 (bookworm) | linux 6.1.8-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < 3c2a2ff67d46106715c2132021b98bd057c27545 | 3c2a2ff67d46106715c2132021b98bd057c27545 |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < d9fde9eab1766170ff2ade67d09178d2cfd78749 | d9fde9eab1766170ff2ade67d09178d2cfd78749 |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < b0ba060d3287108eba17603bee3810e4cf2c272d | b0ba060d3287108eba17603bee3810e4cf2c272d |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < 712bd74eccb9d3626a0a236641962eca8e11a243 | 712bd74eccb9d3626a0a236641962eca8e11a243 |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < 45627a1a6450662e1e0f8174ef07b05710a20062 | 45627a1a6450662e1e0f8174ef07b05710a20062 |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < 0bf463939c09e5b2c35c71ed74a5fd60a74d6a04 | 0bf463939c09e5b2c35c71ed74a5fd60a74d6a04 |
| linux | linux | >= a60be987d45dd510aeb54389526f9957cfab106c < 7633355e5c7f29c049a9048e461427d1d8ed3051 | 7633355e5c7f29c049a9048e461427d1d8ed3051 |
| linux | linux_kernel | < 4.14.304 | 4.14.304 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
| linux | linux_kernel | >= 4.15 < 4.19.271 | 4.19.271 |
| linux | linux_kernel | >= 4.20 < 5.4.230 | 5.4.230 |
| linux | linux_kernel | >= 5.11 < 5.15.90 | 5.15.90 |
| linux | linux_kernel | >= 5.16 < 6.1.8 | 6.1.8 |
| linux | linux_kernel | >= 5.5 < 5.10.165 | 5.10.165 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nilfs2: fix general protection fault in nilfs_btree_insert()
vendor_redhat·2024-08-21·CVSS 5.5
CVE-2023-52900 [MEDIUM] CWE-476 kernel: nilfs2: fix general protection fault in nilfs_btree_insert()
kernel: nilfs2: fix general protection fault in nilfs_btree_insert()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfs_btree_insert()
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node
block by calling __nilfs_btree_get_block() against an invalid virtual
block address, it returns -ENOENT because conversion of the virtual block
address to a disk block address fails. However, this return value is the
same as the internal code that b-tree lookup routines return to indicate
that the block being searched does not exist, so functions that operate on
that b-tree may misbehave.
When nilfs_btree_insert() receives this spurious 'not found' code from
nilfs_btree_do_lookup(), it misunderstands that the 'not found' ch
Debian
CVE-2023-52900: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
vendor_debian·2023·CVSS 5.5
CVE-2023-52900 [MEDIUM] CVE-2023-52900: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete
OSV
CVE-2023-52900: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a cor
osv·2024-08-21·CVSS 5.5
CVE-2023-52900 [MEDIUM] CVE-2023-52900: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a cor
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete
GHSA
GHSA-8hwx-g945-2v69: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfs_btree_insert()
If nilfs2 reads a c
ghsa_unreviewed·2024-08-21
CVE-2023-52900 [MEDIUM] GHSA-8hwx-g945-2v69: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfs_btree_insert()
If nilfs2 reads a c
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfs_btree_insert()
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node
block by calling __nilfs_btree_get_block() against an invalid virtual
block address, it returns -ENOENT because conversion of the virtual block
address to a disk block address fails. However, this return value is the
same as the internal code that b-tree lookup routines return to indicate
that the block being searched does not exist, so functions that operate on
that b-tree may misbehave.
When nilfs_btree_insert() receives this spurious 'not found' code from
nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was
successful and continues the insert operation using incompl
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/0bf463939c09e5b2c35c71ed74a5fd60a74d6a04https://git.kernel.org/stable/c/3c2a2ff67d46106715c2132021b98bd057c27545https://git.kernel.org/stable/c/45627a1a6450662e1e0f8174ef07b05710a20062https://git.kernel.org/stable/c/712bd74eccb9d3626a0a236641962eca8e11a243https://git.kernel.org/stable/c/7633355e5c7f29c049a9048e461427d1d8ed3051https://git.kernel.org/stable/c/b0ba060d3287108eba17603bee3810e4cf2c272dhttps://git.kernel.org/stable/c/d9fde9eab1766170ff2ade67d09178d2cfd78749
2024-08-21
Published