In the Linux kernel, the following vulnerability has been resolved:
ext4: zero i_disksize when initializing the bootloader inode
If the boot loader inode has never been used before, the EXT4IOCSWAPBOOT inode will initialize it, including setting the isize to 0. However, if the "never before used" boot loader has a non-zero isize, then idisksize will be non-zero, and the inconsistency between isize and idisksize can trigger a kernel warning:
WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa RIP: 0010:ext4filewriteiter+0xbc7/0xd10 Call Trace: vfswrite+0x3b1/0x5c0 ksyswrite+0x77/0x160 _x64syswrite+0x22/0x30 dosyscall64+0x39/0x80
Reproducer: 1. create corrupted image and mount it: mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR "sif <5> size 25700" /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 > file 2. Run the reproducer program: posixmemalign(&buf, 1024, 1024) fd = open("file", ORDWR | ODIRECT); ioctl(fd, EXT4IOCSWAPBOOT); write(fd, buf, 1024);
Fix this by setting idisksize as well as isize to zero when initiaizing the boot loader inode.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9a4cc5486356158554f6ad73027d8635a48b34",
"deprecated": false,
"id": "CVE-2023-53101-1cb7193a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cb27b1e76f0cc886ac09055bc41c0ab3f205167",
"deprecated": false,
"id": "CVE-2023-53101-262e41a7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f00c476da8fe7c4c34ea16abb55d74127120413",
"deprecated": false,
"id": "CVE-2023-53101-2c3c48e1",
"signature_type": "Function",
"digest": {
"length": 3029.0,
"function_hash": "279394284143142081902969768403270657191"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6c1447e483c05dbcfb3ff77ac04237a82070b8c",
"deprecated": false,
"id": "CVE-2023-53101-40c3575c",
"signature_type": "Function",
"digest": {
"length": 2080.0,
"function_hash": "282972677177670684623565391402322411296"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59eee0cdf8c036f554add97a4da7c06d7a9ff34a",
"deprecated": false,
"id": "CVE-2023-53101-5f2d7835",
"signature_type": "Function",
"digest": {
"length": 2940.0,
"function_hash": "121448491783908949057336028795728829306"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f00c476da8fe7c4c34ea16abb55d74127120413",
"deprecated": false,
"id": "CVE-2023-53101-64fdc4a5",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59eee0cdf8c036f554add97a4da7c06d7a9ff34a",
"deprecated": false,
"id": "CVE-2023-53101-733fa39e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5361da1e60d54ec81346aee8e3d8baf1be0b762",
"deprecated": false,
"id": "CVE-2023-53101-7738cfdc",
"signature_type": "Function",
"digest": {
"length": 3027.0,
"function_hash": "29868866782903579817080896775972882096"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a821aacc64d4b05dafd239dbc9b7856686002f",
"deprecated": false,
"id": "CVE-2023-53101-924dea09",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9a4cc5486356158554f6ad73027d8635a48b34",
"deprecated": false,
"id": "CVE-2023-53101-982ed0c7",
"signature_type": "Function",
"digest": {
"length": 3027.0,
"function_hash": "29868866782903579817080896775972882096"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5361da1e60d54ec81346aee8e3d8baf1be0b762",
"deprecated": false,
"id": "CVE-2023-53101-b670c475",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d8a6c9a6415999fee1259ccf1796480c026b7d6",
"deprecated": false,
"id": "CVE-2023-53101-d0f78575",
"signature_type": "Function",
"digest": {
"length": 2956.0,
"function_hash": "250105364793671654007015933994114510318"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d8a6c9a6415999fee1259ccf1796480c026b7d6",
"deprecated": false,
"id": "CVE-2023-53101-d4c89b49",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92260439247860535509437850772705374256",
"54717503977772210991911044396420833422",
"111371861536994202752876320995301472002",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a821aacc64d4b05dafd239dbc9b7856686002f",
"deprecated": false,
"id": "CVE-2023-53101-dafc88c7",
"signature_type": "Function",
"digest": {
"length": 3006.0,
"function_hash": "195678211786004860845505761423310840412"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6c1447e483c05dbcfb3ff77ac04237a82070b8c",
"deprecated": false,
"id": "CVE-2023-53101-f4db5125",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309747712490662986409186756527909834001",
"57731245424628005332367091744728346053",
"48174731968353476824406129128080501529",
"237575501789369458373339033377157584732"
]
},
"target": {
"file": "fs/ext4/ioctl.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cb27b1e76f0cc886ac09055bc41c0ab3f205167",
"deprecated": false,
"id": "CVE-2023-53101-f9220e88",
"signature_type": "Function",
"digest": {
"length": 3027.0,
"function_hash": "29868866782903579817080896775972882096"
},
"target": {
"function": "swap_inode_boot_loader",
"file": "fs/ext4/ioctl.c"
}
}
]