CVE-2023-52705

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix underflow in second superblock position calculations

Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second

superblock, underflows when the argument device size is less than 4096

bytes. Therefore, when using this macro, it is necessary to check in

advance that the device size is not less than a lower limit, or at least

that underflow does not occur.

The current nilfs2 implementation lacks this check, causing out-of-bound

block access when mounting devices smaller than 4096 bytes:

I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0

phys_seg 1 prio class 2

NILFS (loop0): unable to read secondary superblock (blocksize = 1024)

In addition, when trying to resize the filesystem to a size below 4096

bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number

of segments to nilfs_sufile_resize(), corrupting parameters such as the

number of segments in superb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References