CVE-2023-52444

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52444
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46 Patch
https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862 Patch
https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28 Patch
https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 Patch
https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310 Patch
https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728 Patch
https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7 Patch
https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Mar 2024, 20:13

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46 - () https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46 - Patch
References () https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862 - () https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862 - Patch
References () https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28 - () https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28 - Patch
References () https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 - () https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 - Patch
References () https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310 - () https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310 - Patch
References () https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728 - () https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728 - Patch
References () https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7 - () https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7 - Patch
References () https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77 - () https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrección para evitar corrupción directa Como informó Al en link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); demás f2fs_put_page(old_dir_page, 0); Quiere el número correcto en el enlace ".." Y el cambio de nombre entre directorios mueve la fuente al nuevo padre, incluso si le hubieran pedido que dejara un espacio en blanco en el lugar anterior. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ Con el siguiente caso de prueba, puede causar corrupción directa, debido a que no llamó a f2fs_set_link() para actualizar el enlace ".." al nuevo directorio . - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Número de inodo incorrecto [0x4] para '..', el ino padre padre es [0x3] [FSCK] otro corrupto errores [falla]
CWE CWE-119
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

22 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 17:15

Updated : 2024-03-14 20:13

NVD link : CVE-2023-52444

Mitre link : CVE-2023-52444

CVE.ORG link : CVE-2023-52444

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer