CVE-2023-53766

Vulnerability

Description The JFS filesystem implementation in the Linux kernel lacked a check to verify that the filesystem is not mounted read-only before starting a transaction in the txBegin function. This oversight could result in a NULL pointer dereference when attempting to begin a transaction on a read-only mount [1].

Exploitation

An attacker with the ability to mount a JFS filesystem as read-only and trigger a filesystem operation that calls txBegin could potentially exploit this issue. The attack requires local access and control over filesystem mounting.

Impact

Successful exploitation leads to a NULL pointer dereference, typically causing a kernel panic and denial of service. No privilege escalation is mentioned.

Mitigation

The vulnerability has been patched in the Linux kernel with commits backported to stable branches [1], [2], [3], and [4]. Users should update their kernel to the latest version to mitigate the risk.