CVE-2023-52933
published 2025-03-27CVE-2023-52933: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
17.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
sanity checking of the xattr_ids count in the filesystem. Both of these
flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which
stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The
variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
type of the sizeof operator is "unsigned long".
On a 64-bit system this is 64-bits in size, and causes the negative number
to be sign extended and widened to 64-bits and then become unsigned. This
produces the very large number 18446744073709548016 or 2^64 - 3600. This
number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and
divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0
(stored in len).
Flaw 2 (32-bit systems only):
On a 32-bit system the integer variable is not widened by the unsigned
long type of the sizeof operator (32-bits), and the signedness of the
variable has no effect due it always being treated as unsigned.
The above corrupted xattr_ids value of 4294967071, when multiplied
overflows and produces the number 4294963696 or 2^32 - 3400. This number
when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by
SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.
The effect of the 0 length computation:
In conjunction with the corrupted xattr_ids field, the filesystem also has
a corrupted xattr_table_start value, where it matches the end of
filesystem value of 850.
This causes the following sanity check code to fail because the
incorrectly computed len of 0 matches the incorrect size of the table
report
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3654a0ed0bdc6d70502bfc7c9fec9f1e243dfcad < 1369322c1de52c7b9b988b95c9903110a4566778 | 1369322c1de52c7b9b988b95c9903110a4566778 |
| linux | linux | >= 4.14.222 < 4.14.306 | 4.14.306 |
| linux | linux | >= 4.19.176 < 4.19.273 | 4.19.273 |
| linux | linux | >= 4.4.258 < 4.5 | 4.5 |
| linux | linux | >= 4.9.258 < 4.10 | 4.10 |
| linux | linux | >= 5.10.16 < 5.10.168 | 5.10.168 |
| linux | linux | >= 5.4.98 < 5.4.232 | 5.4.232 |
| linux | linux | >= 506220d2ba21791314af569211ffd8870b8208fa < 997bed0f3cde78a3e639d624985bf4a95cf767e6 | 997bed0f3cde78a3e639d624985bf4a95cf767e6 |
| linux | linux | >= 506220d2ba21791314af569211ffd8870b8208fa < a7da7d01ac5ce9b369a1ac70e1197999cc6c9686 | a7da7d01ac5ce9b369a1ac70e1197999cc6c9686 |
| linux | linux | >= 506220d2ba21791314af569211ffd8870b8208fa < f65c4bbbd682b0877b669828b4e033b8d5d0a2dc | f65c4bbbd682b0877b669828b4e033b8d5d0a2dc |
| linux | linux | >= a8717b34003f4f7353b23826617ad872f85d85d8 < b38c3e9e0adc01956cc3e5a52e4d3f92f79d88e2 | b38c3e9e0adc01956cc3e5a52e4d3f92f79d88e2 |
| linux | linux | >= bddcce15cd1fb9675ddd46a76d8fe2d0a571313b < 5c4d4a83bf1a862d80c1efff1c6e3ce33b501e2e | 5c4d4a83bf1a862d80c1efff1c6e3ce33b501e2e |
| linux | linux | >= ff49cace7b8cf00d27665f7536a863d406963d06 < 7fe583c9bec10cd4b76231c51b37f3e4ca646e01 | 7fe583c9bec10cd4b76231c51b37f3e4ca646e01 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 4.14.222 < 4.14.306 | 4.14.306 |
| linux | linux_kernel | >= 4.19.176 < 4.19.273 | 4.19.273 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-52933: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupt
osv·2025-03-27·CVSS 5.5
CVE-2023-52933 [MEDIUM] CVE-2023-52933: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupt
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing. In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225. Flaw 1 (64-bit systems only): The signed integer xattr_ids variable causes sign extension. This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long". On a 64-bit system this is 64-bits in size, and causes
GHSA
GHSA-f76f-mm36-mf6v: In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corru
ghsa_unreviewed·2025-03-27
CVE-2023-52933 [MEDIUM] CWE-190 GHSA-f76f-mm36-mf6v: In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corru
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
sanity checking of the xattr_ids count in the filesystem. Both of these
flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which
stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The
variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
type of the sizeof operator is "unsigned long".
On a 64-bit system this is 64-bits in size, and
Red Hat
kernel: Squashfs: fix handling and sanity checking of xattr_ids count
vendor_redhat·2025-03-27·CVSS 5.5
CVE-2023-52933 [MEDIUM] CWE-190 kernel: Squashfs: fix handling and sanity checking of xattr_ids count
kernel: Squashfs: fix handling and sanity checking of xattr_ids count
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
sanity checking of the xattr_ids count in the filesystem. Both of these
flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which
stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The
variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
type of the sizeof operator is
Debian
CVE-2023-52933: linux - In the Linux kernel, the following vulnerability has been resolved: Squashfs: f...
vendor_debian·2023·CVSS 5.5
CVE-2023-52933 [MEDIUM] CVE-2023-52933: linux - In the Linux kernel, the following vulnerability has been resolved: Squashfs: f...
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing. In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225. Flaw 1 (64-bit systems only): The signed integer xattr_ids variable causes sign extension. This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long". On a 64-bit system this is 64-bits in size, and causes
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1369322c1de52c7b9b988b95c9903110a4566778https://git.kernel.org/stable/c/5c4d4a83bf1a862d80c1efff1c6e3ce33b501e2ehttps://git.kernel.org/stable/c/7fe583c9bec10cd4b76231c51b37f3e4ca646e01https://git.kernel.org/stable/c/997bed0f3cde78a3e639d624985bf4a95cf767e6https://git.kernel.org/stable/c/a7da7d01ac5ce9b369a1ac70e1197999cc6c9686https://git.kernel.org/stable/c/b38c3e9e0adc01956cc3e5a52e4d3f92f79d88e2https://git.kernel.org/stable/c/f65c4bbbd682b0877b669828b4e033b8d5d0a2dc
2025-03-27
Published