CVE-2023-53270

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_disksize exceeding i_size problem in paritally written case

It is possible for i_disksize can exceed i_size, triggering a warning.

generic_perform_write

copied = iov_iter_copy_from_user_atomic(len) // copied < len

ext4_da_write_end

| ext4_update_i_disksize

| new_i_size = pos + copied;

| WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize

| generic_write_end

| copied = block_write_end(copied, len) // copied = 0

| if (unlikely(copied < len))

| if (!PageUptodate(page))

| copied = 0;

| if (pos + copied > inode->i_size) // return false

if (unlikely(copied == 0))

goto again;

if (unlikely(iov_iter_fault_in_readable(i, bytes))) {

status = -EFAULT;

break;

}

We get i_disksize greater than i_size here, which could trigger WARNING

check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:

ext4_dio_write_iter

iomap_dio_rw

__iomap_dio_rw // return err,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References