CVE-2023-54062

Vulnerability

Overview

In the Linux kernel's ext4 filesystem, the function ext4_xattr_move_to_block() contains a vulnerability related to invalid free tracking. When moving an extended attribute to an external block, the code attempts to determine whether the value buffer was allocated by kvmalloc() by checking entry->e_value_inum. However, after the xattr entry is removed from its original location, the pointer becomes invalid, making this check unreliable.

Attack

Surface and Exploitation

This vulnerability can be triggered locally by an attacker who can cause ext4 extended attribute operations. The prerequisite is the ability to manipulate extended attributes on an ext4 filesystem. No special privileges are required beyond normal file access permissions, making it exploitable from userspace.

Impact

An attacker exploiting this flaw could cause the kernel to call kvfree() on a pointer not allocated by kvmalloc(), leading to memory corruption or kernel panic. Alternatively, the buffer may not be freed when it should be, resulting in a memory leak. Both scenarios can lead to system instability or denial of service.

Mitigation

The issue has been fixed in the Linux kernel through stable commits [1][2][3][4]. Users should apply the latest stable kernel updates to mitigate the vulnerability.