CVE-2023-53820

Root

Cause

The vulnerability resides in the loop_set_status_from_info() function of the Linux kernel's loop block driver. The function updates lo->lo_offset and lo->lo_sizelimit without first validating the new values for potential overflow. If an overflow error occurs during the reassignment, the original correct values are overwritten with incorrect values and never restored [1][2][3][4].

Exploitation

Path

An attacker with the ability to issue LOOP_SET_STATUS ioctl calls on a loop device (typically requiring either local access or the ability to control a process that has the device open) can trigger this flaw. By providing crafted offset or sizelimit values that cause arithmetic overflow during assignment, the attacker corrupts the device's internal state. The corruption then persists across subsequent I/O operations because the driver does not revert the fields after detecting the error [1][2][3][4].

Impact

After the corrupted values are set, I/O operations on the loop device compute file positions using the invalid offset, as seen in loop_handle_cmd() -> do_req_filebacked() -> loff_t pos = ... + lo->lo_offset. This can lead to out-of-bounds reads or writes on the backing file, potentially causing data corruption, information disclosure, or system instability [1][2][3][4].

Mitigation

The fix ensures that the new values for lo->lo_offset and lo->lo_sizelimit are validated *before* any assignment occurs. If an overflow is detected, the function returns an error without altering the device's state. The patch has been merged into the stable kernel trees; users should apply the relevant updates (commit IDs 258809bf22bf, 6bdf4e6dfb60, 861021710bba, and 2ea7077748e5) [1][2][3][4].