cbcvebase.
CVE-2023-53143
published 2025-05-02

CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
7.8th percentile
In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000 RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11 RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400 R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001 R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398 FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0 Call Trace: ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __x64_sys_ioctl+0x82/0xa0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf20558aff RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff RDX: 00007fdf1feb2

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.20-1 (bookworm)linux 6.1.20-1 (bookworm)
linuxlinux
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < a70b49dc7eee5dbe3775a650ce598e3557ff5475a70b49dc7eee5dbe3775a650ce598e3557ff5475
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < f16054ac1774915160ca4e1c73ff7a269465a1b9f16054ac1774915160ca4e1c73ff7a269465a1b9
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c24f838493792b5e78a3596b4ca96375aa0af4c2c24f838493792b5e78a3596b4ca96375aa0af4c2
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < 1d2366624b4c19a2ba6baf67fe57f4a1b0f67c051d2366624b4c19a2ba6baf67fe57f4a1b0f67c05
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c5d7c31e17224d847a330180ec1b03bf390632b2c5d7c31e17224d847a330180ec1b03bf390632b2
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < eb3a695aa71a514f2e7f5778e05faba3733b70a0eb3a695aa71a514f2e7f5778e05faba3733b70a0
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < 15ebade3266b300da9cd1edce4004fe8fd6a2b8815ebade3266b300da9cd1edce4004fe8fd6a2b88
linuxlinux>= 4a4956249dac0b9b0027949907bff0cd1a9b57fa < c993799baf9c5861f8df91beb80e1611b12efcbdc993799baf9c5861f8df91beb80e1611b12efcbd
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 0 < 6.1.20-16.1.20-1
linuxlinux_kernel>= 4.13 < 4.14.3104.14.310
linuxlinux_kernel>= 4.15 < 4.19.2784.19.278
linuxlinux_kernel>= 4.20 < 5.4.2375.4.237
linuxlinux_kernel>= 5.11 < 5.15.1035.15.103
linuxlinux_kernel>= 5.16 < 6.1.206.1.20
linuxlinux_kernel>= 5.5 < 5.10.1755.10.175
linuxlinux_kernel>= 6.2 < 6.2.76.2.7

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.