Vulnerability-Lookup

FKIE_CVE-2023-53503

Vulnerability from fkie_nvd - Published: 2025-10-01 12:15 - Updated: 2026-01-26 19:52

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4_get_group_info() to fail Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attaker (or fuzzer) modifies the superblock via the block device while it is the file system is mounted, it is possible for s_first_data_block to get set to a very large number. In that case, when calculating the block group of some block number (such as the starting block of a preallocation region), could result in an underflow and very large block group number. Then the BUG_ON check in ext4_get_group_info() would fire, resutling in a denial of service attack that can be triggered by root or someone with write access to the block device. For a quality of implementation perspective, it's best that even if the system administrator does something that they shouldn't, that it will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info() will call ext4_error and return NULL. We also add fallback code in all of the callers of ext4_get_group_info() that it might NULL. Also, since ext4_get_group_info() was already borderline to be an inline function, un-inline it. The results in a next reduction of the compiled text size of ext4 by roughly 2k.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.4

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B7B3683-E9CA-4312-979C-328358185649",
              "versionEndExcluding": "5.10.181",
              "versionStartIncluding": "3.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3D5E1B5-AB9D-4ECC-8F11-F3E1BF761E27",
              "versionEndExcluding": "5.15.113",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9430E62-03EA-42E6-9E5E-BD1D5124D107",
              "versionEndExcluding": "6.1.30",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "26C54BF0-3EED-46D4-92A7-5F07F658B49B",
              "versionEndExcluding": "6.3.4",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "38BC6744-7D25-4C02-9966-B224CD071D30",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: allow ext4_get_group_info() to fail\n\nPreviously, ext4_get_group_info() would treat an invalid group number\nas BUG(), since in theory it should never happen.  However, if a\nmalicious attaker (or fuzzer) modifies the superblock via the block\ndevice while it is the file system is mounted, it is possible for\ns_first_data_block to get set to a very large number.  In that case,\nwhen calculating the block group of some block number (such as the\nstarting block of a preallocation region), could result in an\nunderflow and very large block group number.  Then the BUG_ON check in\next4_get_group_info() would fire, resutling in a denial of service\nattack that can be triggered by root or someone with write access to\nthe block device.\n\nFor a quality of implementation perspective, it\u0027s best that even if\nthe system administrator does something that they shouldn\u0027t, that it\nwill not trigger a BUG.  So instead of BUG\u0027ing, ext4_get_group_info()\nwill call ext4_error and return NULL.  We also add fallback code in\nall of the callers of ext4_get_group_info() that it might NULL.\n\nAlso, since ext4_get_group_info() was already borderline to be an\ninline function, un-inline it.  The results in a next reduction of the\ncompiled text size of ext4 by roughly 2k."
    }
  ],
  "id": "CVE-2023-53503",
  "lastModified": "2026-01-26T19:52:17.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-10-01T12:15:53.917",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-53503 (GCVE-0-2023-53503)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2026-01-05 10:21

Title

ext4: allow ext4_get_group_info() to fail

Summary

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/100c0ad6c04597fef…
	https://git.kernel.org/stable/c/620a3c28221bb219b…
	https://git.kernel.org/stable/c/b4319e457d6e3fb33…
	https://git.kernel.org/stable/c/31668cebf45adfb62…
	https://git.kernel.org/stable/c/5354b2af34064a457…

Impacted products

Vendor

Product

Version

Linux

Affected: 2f2e09eb15849562aede80ed007658e4504ded26 , < 100c0ad6c04597fefeaaba2bb1827cc015d95067 (git)
Affected: 2f2e09eb15849562aede80ed007658e4504ded26 , < 620a3c28221bb219b81bc0bffd065cc187494302 (git)
Affected: 2f2e09eb15849562aede80ed007658e4504ded26 , < b4319e457d6e3fb33e443efeaf4634fc36e8a9ed (git)
Affected: 2f2e09eb15849562aede80ed007658e4504ded26 , < 31668cebf45adfb6283e465e641c4f5a21b07afa (git)
Affected: 2f2e09eb15849562aede80ed007658e4504ded26 , < 5354b2af34064a4579be8bc0e2f15a7b70f14b5f (git)

Linux

Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/balloc.c",
            "fs/ext4/ext4.h",
            "fs/ext4/ialloc.c",
            "fs/ext4/mballoc.c",
            "fs/ext4/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "100c0ad6c04597fefeaaba2bb1827cc015d95067",
              "status": "affected",
              "version": "2f2e09eb15849562aede80ed007658e4504ded26",
              "versionType": "git"
            },
            {
              "lessThan": "620a3c28221bb219b81bc0bffd065cc187494302",
              "status": "affected",
              "version": "2f2e09eb15849562aede80ed007658e4504ded26",
              "versionType": "git"
            },
            {
              "lessThan": "b4319e457d6e3fb33e443efeaf4634fc36e8a9ed",
              "status": "affected",
              "version": "2f2e09eb15849562aede80ed007658e4504ded26",
              "versionType": "git"
            },
            {
              "lessThan": "31668cebf45adfb6283e465e641c4f5a21b07afa",
              "status": "affected",
              "version": "2f2e09eb15849562aede80ed007658e4504ded26",
              "versionType": "git"
            },
            {
              "lessThan": "5354b2af34064a4579be8bc0e2f15a7b70f14b5f",
              "status": "affected",
              "version": "2f2e09eb15849562aede80ed007658e4504ded26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/balloc.c",
            "fs/ext4/ext4.h",
            "fs/ext4/ialloc.c",
            "fs/ext4/mballoc.c",
            "fs/ext4/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: allow ext4_get_group_info() to fail\n\nPreviously, ext4_get_group_info() would treat an invalid group number\nas BUG(), since in theory it should never happen.  However, if a\nmalicious attaker (or fuzzer) modifies the superblock via the block\ndevice while it is the file system is mounted, it is possible for\ns_first_data_block to get set to a very large number.  In that case,\nwhen calculating the block group of some block number (such as the\nstarting block of a preallocation region), could result in an\nunderflow and very large block group number.  Then the BUG_ON check in\next4_get_group_info() would fire, resutling in a denial of service\nattack that can be triggered by root or someone with write access to\nthe block device.\n\nFor a quality of implementation perspective, it\u0027s best that even if\nthe system administrator does something that they shouldn\u0027t, that it\nwill not trigger a BUG.  So instead of BUG\u0027ing, ext4_get_group_info()\nwill call ext4_error and return NULL.  We also add fallback code in\nall of the callers of ext4_get_group_info() that it might NULL.\n\nAlso, since ext4_get_group_info() was already borderline to be an\ninline function, un-inline it.  The results in a next reduction of the\ncompiled text size of ext4 by roughly 2k."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T10:21:00.886Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067"
        },
        {
          "url": "https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa"
        },
        {
          "url": "https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f"
        }
      ],
      "title": "ext4: allow ext4_get_group_info() to fail",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53503",
    "datePublished": "2025-10-01T11:45:54.052Z",
    "dateReserved": "2025-10-01T11:39:39.404Z",
    "dateUpdated": "2026-01-05T10:21:00.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-53503

CVE-2023-53503 (GCVE-0-2023-53503)

Tags

Sightings

Nomenclature