CVE-2023-53323

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext2/dax: Fix ext2_setsize when len is page aligned

PAGE_ALIGN(x) macro gives the next highest value which is multiple of

pagesize. But if x is already page aligned then it simply returns x.

So, if x passed is 0 in dax_zero_range() function, that means the

length gets passed as 0 to ->iomap_begin().

In ext2 it then calls ext2_get_blocks -> max_blocks as 0 and hits bug_on

here in ext2_get_blocks().

BUG_ON(maxblocks == 0);

Instead we should be calling dax_truncate_page() here which takes

care of it. i.e. it only calls dax_zero_range if the offset is not

page/block aligned.

This can be easily triggered with following on fsdax mounted pmem

device.

dd if=/dev/zero of=file count=1 bs=512

truncate -s 0 file

[79.525838] EXT2-fs (pmem0): DAX enabled. Warning: EXPERIMENTAL, use at your own risk

[79.529376] ext2 filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff)

[93.793207] ------------[ cu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References