CVE-2023-53503

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: allow ext4_get_group_info() to fail

Previously, ext4_get_group_info() would treat an invalid group number

as BUG(), since in theory it should never happen. However, if a

malicious attaker (or fuzzer) modifies the superblock via the block

device while it is the file system is mounted, it is possible for

s_first_data_block to get set to a very large number. In that case,

when calculating the block group of some block number (such as the

starting block of a preallocation region), could result in an

underflow and very large block group number. Then the BUG_ON check in

ext4_get_group_info() would fire, resutling in a denial of service

attack that can be triggered by root or someone with write access to

the block device.

For a quality of implementation perspective, it's best that even if

the system administrator does something that they shouldn't, that it

will not trigger a BUG. So instead of BUG'ing, ext4_get_g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References