CVE-2023-53035
published 2025-05-02CVE-2023-53035: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function…
PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.21%
11.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
metadata array to/from user space, may copy uninitialized buffer regions
to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by
the v_size member of the argument nilfs_argv structure is larger than the
size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33
instrument_copy_to_user include/linux/instrumented.h:121 [inline]
_copy_to_user+0xc0/0x100 lib/usercopy.c:33
copy_to_user include/linux/uaccess.h:169 [inline]
nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
__do_compat_sys_ioctl fs/ioctl.c:968 [inline]
__se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
__ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572
alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287
__get_free_pages+0x34/0xc0 mm/page_alloc.c:5599
nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioc
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < a94932381e8dae4117e9129b3c1282e18aa97b05 | a94932381e8dae4117e9129b3c1282e18aa97b05 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 9c5034e9a0e03db8d5e9eabb176340259b5b97e4 | 9c5034e9a0e03db8d5e9eabb176340259b5b97e4 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6 | 8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < d18db946cc6a394291539e030df32324285648f7 | d18db946cc6a394291539e030df32324285648f7 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 5bb105cc72beb9d51bf12f5c657336d2d35bdc5d | 5bb105cc72beb9d51bf12f5c657336d2d35bdc5d |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 5f33b042f74fc9662eba17f4cd19b07d84bbc6c5 | 5f33b042f74fc9662eba17f4cd19b07d84bbc6c5 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 8a6550b365c0ce2e65905de57dcbfe1f7d629726 | 8a6550b365c0ce2e65905de57dcbfe1f7d629726 |
| linux | linux | >= 003ff182fddde09ddfb8d079bbdb02f9d2122082 < 003587000276f81d0114b5ce773d80c119d8cb30 | 003587000276f81d0114b5ce773d80c119d8cb30 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 2.6.31 < 4.14.312 | 4.14.312 |
| linux | linux_kernel | >= 4.15 < 4.19.280 | 4.19.280 |
| linux | linux_kernel | >= 4.20 < 5.4.240 | 5.4.240 |
| linux | linux_kernel | >= 5.11 < 5.15.105 | 5.15.105 |
| linux | linux_kernel | >= 5.16 < 6.1.22 | 6.1.22 |
| linux | linux_kernel | >= 5.5 < 5.10.177 | 5.10.177 |
| linux | linux_kernel | >= 6.2 < 6.2.9 | 6.2.9 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
vendor_redhat·2025-05-02·CVSS 7.1
CVE-2023-53035 [HIGH] kernel: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
kernel: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
metadata array to/from user space, may copy uninitialized buffer regions
to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by
the v_size member of the argument nilfs_argv structure is larger than the
size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/lin
Debian
CVE-2023-53035: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
vendor_debian·2023·CVSS 7.1
CVE-2023-53035 [HIGH] CVE-2023-53035: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO. This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side. KMSAN-enabled kernels detect this issue as follows: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _c
OSV
CVE-2023-53035: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function n
osv·2025-05-02·CVSS 7.1
CVE-2023-53035 [HIGH] CVE-2023-53035: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function n
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO. This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side. KMSAN-enabled kernels detect this issue as follows: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _c
GHSA
GHSA-8xff-q6g9-rjjv: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
The ioctl helper function
ghsa_unreviewed·2025-05-02
CVE-2023-53035 [HIGH] GHSA-8xff-q6g9-rjjv: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
The ioctl helper function
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
metadata array to/from user space, may copy uninitialized buffer regions
to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by
the v_size member of the argument nilfs_argv structure is larger than the
size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/003587000276f81d0114b5ce773d80c119d8cb30https://git.kernel.org/stable/c/5bb105cc72beb9d51bf12f5c657336d2d35bdc5dhttps://git.kernel.org/stable/c/5f33b042f74fc9662eba17f4cd19b07d84bbc6c5https://git.kernel.org/stable/c/8a6550b365c0ce2e65905de57dcbfe1f7d629726https://git.kernel.org/stable/c/8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6https://git.kernel.org/stable/c/9c5034e9a0e03db8d5e9eabb176340259b5b97e4https://git.kernel.org/stable/c/a94932381e8dae4117e9129b3c1282e18aa97b05https://git.kernel.org/stable/c/d18db946cc6a394291539e030df32324285648f7
2025-05-02
Published