CVE-2023-53035

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()

The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a

metadata array to/from user space, may copy uninitialized buffer regions

to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO

and NILFS_IOCTL_GET_CPINFO.

This can occur when the element size of the user space metadata given by

the v_size member of the argument nilfs_argv structure is larger than the

size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo

structure) on the file system side.

KMSAN-enabled kernels detect this issue as follows:

BUG: KMSAN: kernel-infoleak in instrument_copy_to_user

include/linux/instrumented.h:121 [inline]

BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33

instrument_copy_to_user include/linux/instrumented.h:121 [inline]

_copy_to_user+0xc0/0x100 lib/usercopy.c:33

copy_to_user include/linux/uaccess.h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References