CVE-2023-53101

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: zero i_disksize when initializing the bootloader inode

If the boot loader inode has never been used before, the

EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the

i_size to 0. However, if the "never before used" boot loader has a

non-zero i_size, then i_disksize will be non-zero, and the

inconsistency between i_size and i_disksize can trigger a kernel

warning:

WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319

CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa

RIP: 0010:ext4_file_write_iter+0xbc7/0xd10

Call Trace:

vfs_write+0x3b1/0x5c0

ksys_write+0x77/0x160

__x64_sys_write+0x22/0x30

do_syscall_64+0x39/0x80

Reproducer:

1. create corrupted image and mount it:

mke2fs -t ext4 /tmp/foo.img 200

debugfs -wR "sif <5> size 25700" /tmp/foo.img

mount -t ext4 /tmp/foo.img /mnt

cd /mnt

echo 123 > file

2. Run the reproducer program:

posi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References