CVE-2023-53143 (GCVE-0-2023-53143)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:56 – Updated: 2026-05-11 19:39
VLAI
Title
ext4: fix another off-by-one fsmap error on 1k block filesystems
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000 RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11 RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400 R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001 R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398 FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0 Call Trace: <TASK> ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __x64_sys_ioctl+0x82/0xa0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf20558aff RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003 RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010 R13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000 For GETFSMAP calls, the caller selects a physical block device by writing its block number into fsmap_head.fmh_keys[01].fmr_device. To query mappings for a subrange of the device, the starting byte of the range is written to fsmap_head.fmh_keys[0].fmr_physical and the last byte of the range goes in fsmap_head.fmh_keys[1].fmr_physical. IOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd set the inputs as follows: fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3}, fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14}, Which would return you whatever is mapped in the 12 bytes starting at physical offset 3. The crash is due to insufficient range validation of keys[1] in ext4_getfsmap_datadev. On 1k-block filesystems, block 0 is not part of the filesystem, which means that s_first_data_block is nonzero. ext4_get_group_no_and_offset subtracts this quantity from the blocknr argument before cracking it into a group number and a block number within a group. IOWs, block group 0 spans blocks 1-8192 (1-based) instead of 0-8191 (0-based) like what happens with larger blocksizes. The net result of this encoding is that blocknr < s_first_data_block is not a valid input to this function. The end_fsb variable is set from the keys that are copied from userspace, which means that in the above example, its value is zero. That leads to an underflow here: blocknr = blocknr - le32_to_cpu(es->s_first_data_block); The division then operates on -1: offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) >> EXT4_SB(sb)->s_cluster_bits; Leaving an impossibly large group number (2^32-1) in blocknr. ext4_getfsmap_check_keys checked that keys[0 ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < a70b49dc7eee5dbe3775a650ce598e3557ff5475 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < f16054ac1774915160ca4e1c73ff7a269465a1b9 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < c24f838493792b5e78a3596b4ca96375aa0af4c2 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < 1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < c5d7c31e17224d847a330180ec1b03bf390632b2 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < eb3a695aa71a514f2e7f5778e05faba3733b70a0 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < 15ebade3266b300da9cd1edce4004fe8fd6a2b88 (git)
Affected: 4a4956249dac0b9b0027949907bff0cd1a9b57fa , < c993799baf9c5861f8df91beb80e1611b12efcbd (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 4.14.310 , ≤ 4.14.* (semver)
Unaffected: 4.19.278 , ≤ 4.19.* (semver)
Unaffected: 5.4.237 , ≤ 5.4.* (semver)
Unaffected: 5.10.175 , ≤ 5.10.* (semver)
Unaffected: 5.15.103 , ≤ 5.15.* (semver)
Unaffected: 6.1.20 , ≤ 6.1.* (semver)
Unaffected: 6.2.7 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/fsmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a70b49dc7eee5dbe3775a650ce598e3557ff5475",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "f16054ac1774915160ca4e1c73ff7a269465a1b9",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "c24f838493792b5e78a3596b4ca96375aa0af4c2",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "c5d7c31e17224d847a330180ec1b03bf390632b2",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "eb3a695aa71a514f2e7f5778e05faba3733b70a0",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "15ebade3266b300da9cd1edce4004fe8fd6a2b88",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            },
            {
              "lessThan": "c993799baf9c5861f8df91beb80e1611b12efcbd",
              "status": "affected",
              "version": "4a4956249dac0b9b0027949907bff0cd1a9b57fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/fsmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.310",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.310",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.278",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.237",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.175",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.20",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.7",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix another off-by-one fsmap error on 1k block filesystems\n\nApparently syzbot figured out that issuing this FSMAP call:\n\nstruct fsmap_head cmd = {\n\t.fmh_count\t= ...;\n\t.fmh_keys\t= {\n\t\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\n\t\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\n\t},\n...\n};\nret = ioctl(fd, FS_IOC_GETFSMAP, \u0026cmd);\n\nProduces this crash if the underlying filesystem is a 1k-block ext4\nfilesystem:\n\nkernel BUG at fs/ext4/ext4.h:3331!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 3 PID: 3227965 Comm: xfs_io Tainted: G        W  O       6.2.0-rc8-achx\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]\nRSP: 0018:ffffc90007c03998 EFLAGS: 00010246\nRAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000\nRDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11\nRBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400\nR10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001\nR13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398\nFS:  00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0\nCall Trace:\n \u003cTASK\u003e\n ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n __x64_sys_ioctl+0x82/0xa0\n do_syscall_64+0x2b/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7fdf20558aff\nRSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff\nRDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003\nRBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010\nR13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000\n\nFor GETFSMAP calls, the caller selects a physical block device by\nwriting its block number into fsmap_head.fmh_keys[01].fmr_device.\nTo query mappings for a subrange of the device, the starting byte of the\nrange is written to fsmap_head.fmh_keys[0].fmr_physical and the last\nbyte of the range goes in fsmap_head.fmh_keys[1].fmr_physical.\n\nIOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you\u0027d\nset the inputs as follows:\n\n\tfmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3},\n\tfmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14},\n\nWhich would return you whatever is mapped in the 12 bytes starting at\nphysical offset 3.\n\nThe crash is due to insufficient range validation of keys[1] in\next4_getfsmap_datadev.  On 1k-block filesystems, block 0 is not part of\nthe filesystem, which means that s_first_data_block is nonzero.\next4_get_group_no_and_offset subtracts this quantity from the blocknr\nargument before cracking it into a group number and a block number\nwithin a group.  IOWs, block group 0 spans blocks 1-8192 (1-based)\ninstead of 0-8191 (0-based) like what happens with larger blocksizes.\n\nThe net result of this encoding is that blocknr \u003c s_first_data_block is\nnot a valid input to this function.  The end_fsb variable is set from\nthe keys that are copied from userspace, which means that in the above\nexample, its value is zero.  That leads to an underflow here:\n\n\tblocknr = blocknr - le32_to_cpu(es-\u003es_first_data_block);\n\nThe division then operates on -1:\n\n\toffset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) \u003e\u003e\n\t\tEXT4_SB(sb)-\u003es_cluster_bits;\n\nLeaving an impossibly large group number (2^32-1) in blocknr.\next4_getfsmap_check_keys checked that keys[0\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:39:16.726Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a70b49dc7eee5dbe3775a650ce598e3557ff5475"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16054ac1774915160ca4e1c73ff7a269465a1b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c24f838493792b5e78a3596b4ca96375aa0af4c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5d7c31e17224d847a330180ec1b03bf390632b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3a695aa71a514f2e7f5778e05faba3733b70a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/15ebade3266b300da9cd1edce4004fe8fd6a2b88"
        },
        {
          "url": "https://git.kernel.org/stable/c/c993799baf9c5861f8df91beb80e1611b12efcbd"
        }
      ],
      "title": "ext4: fix another off-by-one fsmap error on 1k block filesystems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53143",
    "datePublished": "2025-05-02T15:56:13.656Z",
    "dateReserved": "2025-05-02T15:51:43.564Z",
    "dateUpdated": "2026-05-11T19:39:16.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53143",
      "date": "2026-09-15",
      "epss": "0.00185",
      "percentile": "0.0823"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53143\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:33.240\",\"lastModified\":\"2026-06-17T06:44:22.710\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix another off-by-one fsmap error on 1k block filesystems\\n\\nApparently syzbot figured out that issuing this FSMAP call:\\n\\nstruct fsmap_head cmd = {\\n\\t.fmh_count\\t= ...;\\n\\t.fmh_keys\\t= {\\n\\t\\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\\n\\t\\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\\n\\t},\\n...\\n};\\nret = ioctl(fd, FS_IOC_GETFSMAP, \u0026cmd);\\n\\nProduces this crash if the underlying filesystem is a 1k-block ext4\\nfilesystem:\\n\\nkernel BUG at fs/ext4/ext4.h:3331!\\ninvalid opcode: 0000 [#1] PREEMPT SMP\\nCPU: 3 PID: 3227965 Comm: xfs_io Tainted: G        W  O       6.2.0-rc8-achx\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\\nRIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]\\nRSP: 0018:ffffc90007c03998 EFLAGS: 00010246\\nRAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000\\nRDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11\\nRBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400\\nR10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001\\nR13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398\\nFS:  00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0\\nCall Trace:\\n \u003cTASK\u003e\\n ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\\n ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\\n ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\\n ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\\n __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\\n __x64_sys_ioctl+0x82/0xa0\\n do_syscall_64+0x2b/0x80\\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\\nRIP: 0033:0x7fdf20558aff\\nRSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\\nRAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff\\nRDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003\\nRBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001\\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010\\nR13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000\\n\\nFor GETFSMAP calls, the caller selects a physical block device by\\nwriting its block number into fsmap_head.fmh_keys[01].fmr_device.\\nTo query mappings for a subrange of the device, the starting byte of the\\nrange is written to fsmap_head.fmh_keys[0].fmr_physical and the last\\nbyte of the range goes in fsmap_head.fmh_keys[1].fmr_physical.\\n\\nIOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you\u0027d\\nset the inputs as follows:\\n\\n\\tfmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3},\\n\\tfmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14},\\n\\nWhich would return you whatever is mapped in the 12 bytes starting at\\nphysical offset 3.\\n\\nThe crash is due to insufficient range validation of keys[1] in\\next4_getfsmap_datadev.  On 1k-block filesystems, block 0 is not part of\\nthe filesystem, which means that s_first_data_block is nonzero.\\next4_get_group_no_and_offset subtracts this quantity from the blocknr\\nargument before cracking it into a group number and a block number\\nwithin a group.  IOWs, block group 0 spans blocks 1-8192 (1-based)\\ninstead of 0-8191 (0-based) like what happens with larger blocksizes.\\n\\nThe net result of this encoding is that blocknr \u003c s_first_data_block is\\nnot a valid input to this function.  The end_fsb variable is set from\\nthe keys that are copied from userspace, which means that in the above\\nexample, its value is zero.  That leads to an underflow here:\\n\\n\\tblocknr = blocknr - le32_to_cpu(es-\u003es_first_data_block);\\n\\nThe division then operates on -1:\\n\\n\\toffset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) \u003e\u003e\\n\\t\\tEXT4_SB(sb)-\u003es_cluster_bits;\\n\\nLeaving an impossibly large group number (2^32-1) in blocknr.\\next4_getfsmap_check_keys checked that keys[0\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: corrige otro error de fsmap de un bloque en sistemas de archivos de 1k Aparentemente, syzbot descubri\u00f3 que emitir esta llamada FSMAP: Produce este fallo si el sistema de archivos subyacente es un sistema de archivos ext4 de 1k bloques: \u00a1ERROR del kernel en fs/ext4/ext4.h:3331! C\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Contaminado: GWO 6.2.0-rc8-achx Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 01/04/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000 RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11 RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400 R10: ffffc90007c03950 R11: 0000000000000000 R12: 000000000000001 R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398 FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0 Rastreo de llamadas:  ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __x64_sys_ioctl+0x82/0xa0 hacer_llamada_al_sistema_64+0x2b/0x80 entrada_LLAMADA_AL_SISTEMA_64_despu\u00e9s_de_hwframe+0x46/0xb0 RIP: 0033:0x7fdf20558aff RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003 RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010 R13: 00005625be70d994 R14: 000000000000800 R15: 000000000000000 Para las llamadas GETFSMAP, el llamador selecciona un dispositivo de bloque f\u00edsico escribiendo su n\u00famero de bloque en fsmap_head.fmh_keys[01].fmr_device. Para consultar las asignaciones de un subrango del dispositivo, el byte inicial del rango se escribe en fsmap_head.fmh_keys[0].fmr_physical y el \u00faltimo byte en fsmap_head.fmh_keys[1].fmr_physical. IOWs, para consultar qu\u00e9 asignaciones se superponen con los bytes 3-14 de /dev/sda, debe configurar las entradas de la siguiente manera: fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3}, fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14}, lo que le devolver\u00eda lo que est\u00e9 asignado en los 12 bytes a partir del desplazamiento f\u00edsico 3. El fallo se debe a una validaci\u00f3n de rango insuficiente de keys[1] en ext4_getfsmap_datadev. En sistemas de archivos de 1k bloques, el bloque 0 no forma parte del sistema de archivos, lo que significa que s_first_data_block es distinto de cero. ext4_get_group_no_and_offset resta esta cantidad del argumento blocknr antes de descomponerlo en un n\u00famero de grupo y un n\u00famero de bloque dentro de un grupo. En las IOW, el grupo de bloques 0 abarca los bloques 1-8192 (basado en 1) en lugar de 0-8191 (basado en 0), como ocurre con tama\u00f1os de bloque mayores. El resultado final de esta codificaci\u00f3n es que blocknr \u0026lt; s_first_data_block no es una entrada v\u00e1lida para esta funci\u00f3n. La variable end_fsb se establece a partir de las claves copiadas del espacio de usuario, lo que significa que, en el ejemplo anterior, su valor es cero. Esto genera un desbordamiento por debajo de la capacidad: blocknr = blocknr - le32_to_cpu(es-\u0026gt;s_first_data_block); La divisi\u00f3n opera entonces sobre -1: offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) \u0026gt;\u0026gt; EXT4_SB(sb)-\u0026gt;s_cluster_bits; De esta manera, se deja un n\u00famero de grupo imposiblemente grande (2^32-1) en blocknr. ext4_getfsmap_check_keys verific\u00f3 que keys[0 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/fsmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"a70b49dc7eee5dbe3775a650ce598e3557ff5475\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"f16054ac1774915160ca4e1c73ff7a269465a1b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"c24f838493792b5e78a3596b4ca96375aa0af4c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"c5d7c31e17224d847a330180ec1b03bf390632b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"eb3a695aa71a514f2e7f5778e05faba3733b70a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"15ebade3266b300da9cd1edce4004fe8fd6a2b88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a4956249dac0b9b0027949907bff0cd1a9b57fa\",\"lessThan\":\"c993799baf9c5861f8df91beb80e1611b12efcbd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/fsmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.310\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.278\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.237\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.175\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.103\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.20\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.7\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"4.14.310\",\"matchCriteriaId\":\"2A7D3CCD-563A-43C8-81D5-6EA850FBB5DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.278\",\"matchCriteriaId\":\"1BE5A05F-B15B-4F08-BCE4-7DF115602DC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.237\",\"matchCriteriaId\":\"229D3E63-7A14-4507-9222-7E4821F6FF3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.175\",\"matchCriteriaId\":\"BEA15466-227B-46FF-B5A8-1E8679056A83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.103\",\"matchCriteriaId\":\"7A57CCEF-C453-48CE-9A6E-71A03C369F61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.20\",\"matchCriteriaId\":\"B22D8949-72A1-4CED-8318-A040635DEEBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.7\",\"matchCriteriaId\":\"EFEDDF17-189C-4901-BD6B-41752E80AAA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15ebade3266b300da9cd1edce4004fe8fd6a2b88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d2366624b4c19a2ba6baf67fe57f4a1b0f67c05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a70b49dc7eee5dbe3775a650ce598e3557ff5475\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c24f838493792b5e78a3596b4ca96375aa0af4c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5d7c31e17224d847a330180ec1b03bf390632b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c993799baf9c5861f8df91beb80e1611b12efcbd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eb3a695aa71a514f2e7f5778e05faba3733b70a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f16054ac1774915160ca4e1c73ff7a269465a1b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:10:08+00:00",
      "cve": "CVE-2023-53143",
      "id": "CVE-2023-53143",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "48",
      "product_status:known_not_affected": "226",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix another off-by-one fsmap error on 1k block filesystems",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53143.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:01:03Z",
      "cve": "CVE-2023-53143",
      "id": "CVE-2023-53143",
      "initial_release_date": "2025-05-03T02:49:52Z",
      "product_status:known_affected": "408",
      "product_status:known_not_affected": "316",
      "product_status:recommended": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53143",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53143.json",
      "version": "34"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.