github - ghsa-xc3g-cm27-mcmg

ghsa-xc3g-cm27-mcmg

Vulnerability from github

Published

2024-03-03 00:30

Modified

2024-03-03 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix memory leak of LZMA global compressed deduplication

When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (-Ededupe), I found some short-lived temporary pages weren't properly released, which could slowly cause unexpected OOMs hours later.

Let's fix it now (LZ4 and DEFLATE don't have this issue.)

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-52526"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:48Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix memory leak of LZMA global compressed deduplication\n\nWhen stressing microLZMA EROFS images with the new global compressed\ndeduplication feature enabled (`-Ededupe`), I found some short-lived\ntemporary pages weren\u0027t properly released, which could slowly cause\nunexpected OOMs hours later.\n\nLet\u0027s fix it now (LZ4 and DEFLATE don\u0027t have this issue.)",
  "id": "GHSA-xc3g-cm27-mcmg",
  "modified": "2024-03-03T00:30:32Z",
  "published": "2024-03-03T00:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52526"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a5a8f0a9740f865693d5aa97a42cc4504538e18"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/75a5221630fe5aa3fedba7a06be618db0f79ba1e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c955751cbf864cf2055117dd3fe7f780d2a57b56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2023-52526

Vulnerability from cvelistv5

Published

2024-03-02 21:52

Modified

2024-11-04 14:48

Severity ?

Summary

erofs: fix memory leak of LZMA global compressed deduplication

References

▼	URL	Tags
	https://git.kernel.org/stable/c/6a5a8f0a9740f865693d5aa97a42cc4504538e18
	https://git.kernel.org/stable/c/c955751cbf864cf2055117dd3fe7f780d2a57b56
	https://git.kernel.org/stable/c/75a5221630fe5aa3fedba7a06be618db0f79ba1e

Impacted products

▼	Vendor	Product
	Linux	Linux
	Linux	Linux

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T14:37:17.181611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:24.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.817Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6a5a8f0a9740f865693d5aa97a42cc4504538e18"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c955751cbf864cf2055117dd3fe7f780d2a57b56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75a5221630fe5aa3fedba7a06be618db0f79ba1e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor_lzma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a5a8f0a9740",
              "status": "affected",
              "version": "5c2a64252c5d",
              "versionType": "git"
            },
            {
              "lessThan": "c955751cbf86",
              "status": "affected",
              "version": "5c2a64252c5d",
              "versionType": "git"
            },
            {
              "lessThan": "75a5221630fe",
              "status": "affected",
              "version": "5c2a64252c5d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor_lzma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix memory leak of LZMA global compressed deduplication\n\nWhen stressing microLZMA EROFS images with the new global compressed\ndeduplication feature enabled (`-Ededupe`), I found some short-lived\ntemporary pages weren\u0027t properly released, which could slowly cause\nunexpected OOMs hours later.\n\nLet\u0027s fix it now (LZ4 and DEFLATE don\u0027t have this issue.)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T14:48:34.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a5a8f0a9740f865693d5aa97a42cc4504538e18"
        },
        {
          "url": "https://git.kernel.org/stable/c/c955751cbf864cf2055117dd3fe7f780d2a57b56"
        },
        {
          "url": "https://git.kernel.org/stable/c/75a5221630fe5aa3fedba7a06be618db0f79ba1e"
        }
      ],
      "title": "erofs: fix memory leak of LZMA global compressed deduplication",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52526",
    "datePublished": "2024-03-02T21:52:32.261Z",
    "dateReserved": "2024-02-20T12:30:33.318Z",
    "dateUpdated": "2024-11-04T14:48:34.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted