CVE-2023-54187 (GCVE-0-2023-54187)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 09:17
VLAI
Title
f2fs: fix potential corruption when moving a directory
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential corruption when moving a directory F2FS has the same issue in ext4_rename causing crash revealed by xfstests/generic/707. See also commit 0813299c586b ("ext4: Fix possible corruption when moving a directory")
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < 3e77036246123ff710fa2661dcaa12a45284f09b (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < 957904f531fd857a92743b11fbc9c9ffdf7f3207 (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < 8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9 (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < 8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70 (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < f20191100952013f0916418cdaed0ab55c7b634c (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < 0a76082a4a32a90d1ef33dee8b400efc082b4b6f (git)
Affected: 622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce , < d94772154e524b329a168678836745d2773a6e02 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.4.243 , ≤ 5.4.* (semver)
Unaffected: 5.10.180 , ≤ 5.10.* (semver)
Unaffected: 5.15.112 , ≤ 5.15.* (semver)
Unaffected: 6.1.29 , ≤ 6.1.* (semver)
Unaffected: 6.2.16 , ≤ 6.2.* (semver)
Unaffected: 6.3.3 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e77036246123ff710fa2661dcaa12a45284f09b",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "957904f531fd857a92743b11fbc9c9ffdf7f3207",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "f20191100952013f0916418cdaed0ab55c7b634c",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "0a76082a4a32a90d1ef33dee8b400efc082b4b6f",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            },
            {
              "lessThan": "d94772154e524b329a168678836745d2773a6e02",
              "status": "affected",
              "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.243",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.180",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.112",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.29",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix potential corruption when moving a directory\n\nF2FS has the same issue in ext4_rename causing crash revealed by\nxfstests/generic/707.\n\nSee also commit 0813299c586b (\"ext4: Fix possible corruption when moving a directory\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the ordinary rename()/renameat2() syscall on a locally mounted f2fs filesystem, requiring local system access. No network protocol handler is involved.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues the cross-directory rename while another creates entries in the moved directory to force inline-to-normal dentry conversion \u2014 and the unprotected window spans f2fs_balance_fs() (which can run GC and block for a long time), f2fs_lock_op() and f2fs_add_link(), making it wide and retryable indefinitely.\nPR:L - Any unprivileged local user with write access to two directories on an f2fs mount can trigger this; on Android every app has writable directories on the f2fs /data partition, and inline_dentry is enabled by default in default_options().\nUI:N - The attacker performs both the rename and the concurrent directory-modifying operations itself; no victim action is needed on an already-mounted filesystem.\nS:U - The corruption stays within the kernel/filesystem security authority; there is no crossing into a hypervisor, IOMMU, or other separate security scope.\nC:H - The stale write lands inside the inode\u0027s i_addr[] block-address array, planting an attacker-influenced physical block number into the directory, so subsequent readdir/lookup reads and exposes disk blocks belonging to other users\u0027 files.\nI:H - This is persistent on-disk metadata corruption \u2014 an attacker-influenced 32-bit value is written into a directory inode\u0027s block pointer and marked dirty, causing later directory writes to overwrite blocks owned by other files and producing double-allocated blocks requiring fsck.\nA:H - The commit states the race causes a crash (reproduced by xfstests/generic/707), and the resulting mismatched page-type writeback wait can hang under the page lock while the corrupted metadata triggers -EFSCORRUPTED/SBI_NEED_FSCK filesystem shutdown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:54.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e77036246123ff710fa2661dcaa12a45284f09b"
        },
        {
          "url": "https://git.kernel.org/stable/c/957904f531fd857a92743b11fbc9c9ffdf7f3207"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70"
        },
        {
          "url": "https://git.kernel.org/stable/c/f20191100952013f0916418cdaed0ab55c7b634c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a76082a4a32a90d1ef33dee8b400efc082b4b6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d94772154e524b329a168678836745d2773a6e02"
        }
      ],
      "title": "f2fs: fix potential corruption when moving a directory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54187",
    "datePublished": "2025-12-30T12:08:56.562Z",
    "dateReserved": "2025-12-30T12:06:44.497Z",
    "dateUpdated": "2026-08-05T09:17:54.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54187",
      "date": "2026-10-05",
      "epss": "0.00155",
      "percentile": "0.04"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3e77036246123ff710fa2661dcaa12a45284f09b",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "957904f531fd857a92743b11fbc9c9ffdf7f3207",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f20191100952013f0916418cdaed0ab55c7b634c",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a76082a4a32a90d1ef33dee8b400efc082b4b6f",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d94772154e524b329a168678836745d2773a6e02",
                    "status": "affected",
                    "version": "622f28ae9ba4fa89b4ff0f4a6cf75d153ea838ce",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.243",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.180",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.29",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix potential corruption when moving a directory\n\nF2FS has the same issue in ext4_rename causing crash revealed by\nxfstests/generic/707.\n\nSee also commit 0813299c586b (\"ext4: Fix possible corruption when moving a directory\")"
          }
        ],
        "id": "CVE-2023-54187",
        "lastModified": "2026-08-04T11:16:35.817",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:06.677",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a76082a4a32a90d1ef33dee8b400efc082b4b6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e77036246123ff710fa2661dcaa12a45284f09b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/957904f531fd857a92743b11fbc9c9ffdf7f3207"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d94772154e524b329a168678836745d2773a6e02"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f20191100952013f0916418cdaed0ab55c7b634c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T10:10:31+00:00",
      "cve": "CVE-2023-54187",
      "id": "CVE-2023-54187",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (F2FS): Data corruption and denial of service when moving a directory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54187.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:46:14Z",
      "cve": "CVE-2023-54187",
      "id": "CVE-2023-54187",
      "initial_release_date": "2025-12-31T00:28:58Z",
      "product_status:known_not_affected": "514",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54187",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54187.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.