CVE-2023-53143

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix another off-by-one fsmap error on 1k block filesystems

Apparently syzbot figured out that issuing this FSMAP call:

struct fsmap_head cmd = {

.fmh_count = ...;

.fmh_keys = {

{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },

{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },

},

...

};

ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);

Produces this crash if the underlying filesystem is a 1k-block ext4

filesystem:

kernel BUG at fs/ext4/ext4.h:3331!

invalid opcode: 0000 [#1] PREEMPT SMP

CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014

RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]

RSP: 0018:ffffc90007c03998 EFLAGS: 00010246

RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000

RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11

RBP: ffff888012330000 R08: ffffffffa0c2b7d0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References