CVE-2023-53143
published 2025-05-02CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
7.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzbot figured out that issuing this FSMAP call:
struct fsmap_head cmd = {
.fmh_count = ...;
.fmh_keys = {
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
},
...
};
ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);
Produces this crash if the underlying filesystem is a 1k-block ext4
filesystem:
kernel BUG at fs/ext4/ext4.h:3331!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]
RSP: 0018:ffffc90007c03998 EFLAGS: 00010246
RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000
RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11
RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400
R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001
R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398
FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0
Call Trace:
ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
__ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
__x64_sys_ioctl+0x82/0xa0
do_syscall_64+0x2b/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf20558aff
RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff
RDX: 00007fdf1feb2
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < a70b49dc7eee5dbe3775a650ce598e3557ff5475 | a70b49dc7eee5dbe3775a650ce598e3557ff5475 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < f16054ac1774915160ca4e1c73ff7a269465a1b9 | f16054ac1774915160ca4e1c73ff7a269465a1b9 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c24f838493792b5e78a3596b4ca96375aa0af4c2 | c24f838493792b5e78a3596b4ca96375aa0af4c2 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < 1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05 | 1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c5d7c31e17224d847a330180ec1b03bf390632b2 | c5d7c31e17224d847a330180ec1b03bf390632b2 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < eb3a695aa71a514f2e7f5778e05faba3733b70a0 | eb3a695aa71a514f2e7f5778e05faba3733b70a0 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < 15ebade3266b300da9cd1edce4004fe8fd6a2b88 | 15ebade3266b300da9cd1edce4004fe8fd6a2b88 |
| linux | linux | >= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c993799baf9c5861f8df91beb80e1611b12efcbd | c993799baf9c5861f8df91beb80e1611b12efcbd |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 4.13 < 4.14.310 | 4.14.310 |
| linux | linux_kernel | >= 4.15 < 4.19.278 | 4.19.278 |
| linux | linux_kernel | >= 4.20 < 5.4.237 | 5.4.237 |
| linux | linux_kernel | >= 5.11 < 5.15.103 | 5.15.103 |
| linux | linux_kernel | >= 5.16 < 6.1.20 | 6.1.20 |
| linux | linux_kernel | >= 5.5 < 5.10.175 | 5.10.175 |
| linux | linux_kernel | >= 6.2 < 6.2.7 | 6.2.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot
osv·2025-05-02·CVSS 5.5
CVE-2023-53143 [MEDIUM] CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot
In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RA
GHSA
GHSA-5vjg-59f8-hcq8: In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzb
ghsa_unreviewed·2025-05-02
CVE-2023-53143 [MEDIUM] CWE-193 GHSA-5vjg-59f8-hcq8: In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzb
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzbot figured out that issuing this FSMAP call:
struct fsmap_head cmd = {
.fmh_count = ...;
.fmh_keys = {
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
},
...
};
ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);
Produces this crash if the underlying filesystem is a 1k-block ext4
filesystem:
kernel BUG at fs/ext4/ext4.h:3331!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]
RSP: 0018:ffffc90007c03998 EFLAGS: 000102
Red Hat
kernel: ext4: fix another off-by-one fsmap error on 1k block filesystems
vendor_redhat·2025-05-02·CVSS 5.5
CVE-2023-53143 [MEDIUM] CWE-129 kernel: ext4: fix another off-by-one fsmap error on 1k block filesystems
kernel: ext4: fix another off-by-one fsmap error on 1k block filesystems
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzbot figured out that issuing this FSMAP call:
struct fsmap_head cmd = {
.fmh_count= ...;
.fmh_keys= {
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
},
...
};
ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);
Produces this crash if the underlying filesystem is a 1k-block ext4
filesystem:
kernel BUG at fs/ext4/ext4.h:3331!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_mb_load_bud
Debian
CVE-2023-53143: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix a...
vendor_debian·2023·CVSS 5.5
CVE-2023-53143 [MEDIUM] CVE-2023-53143: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix a...
In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RA
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/15ebade3266b300da9cd1edce4004fe8fd6a2b88https://git.kernel.org/stable/c/1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05https://git.kernel.org/stable/c/a70b49dc7eee5dbe3775a650ce598e3557ff5475https://git.kernel.org/stable/c/c24f838493792b5e78a3596b4ca96375aa0af4c2https://git.kernel.org/stable/c/c5d7c31e17224d847a330180ec1b03bf390632b2https://git.kernel.org/stable/c/c993799baf9c5861f8df91beb80e1611b12efcbdhttps://git.kernel.org/stable/c/eb3a695aa71a514f2e7f5778e05faba3733b70a0https://git.kernel.org/stable/c/f16054ac1774915160ca4e1c73ff7a269465a1b9
2025-05-02
Published