CVE-2023-53845

Vulnerability

Description

CVE-2023-53845 is a vulnerability in the Linux kernel's nilfs2 filesystem. When a corrupted disk image is mounted, nilfs_bmap_lookup_at_level() may erroneously return -ENOENT, confusing nilfs_mdt_get_block() into reading and creating a metadata block indefinitely, resulting in an infinite loop [1].

Attack

Surface

An attacker must supply a corrupted nilfs2 filesystem image that triggers the invalid block lookup. Mounting such an image requires no special privileges beyond the ability to mount a filesystem; however, the attacker must have control over the storage medium or a means to inject the malicious image.

Impact

The infinite loop causes the inode metadata file (ifile) to hold the i_rwsem semaphore indefinitely, leading to task hangs in lock_mount and ultimately system unresponsiveness. This constitutes a denial-of-service (DoS) condition.

Mitigation

Patches have been applied to the Linux kernel stable branches [1][2]. The fix modifies nilfs_bmap_lookup_at_level() to treat -ENOENT from virtual block address translation as metadata corruption rather than propagating the error code, thereby breaking the infinite loop.