CVE-2023-54135

Vulnerability

The mas_wr_end_piv() function in the Linux kernel's maple tree implementation lacked proper bounds checking on the write offset end before using it as an index into the pivot array. When a write operation extends to the last slot in a node, the code could access beyond the allocated pivot array, potentially causing an out-of-bounds read or write [1][2].

Exploitation

Currently, no in-tree callers trigger this path, so the vulnerability is not directly exploitable in upstream kernels. However, if the fix is backported into earlier stable kernels that may have new users of the maple tree, the issue could be triggered by those new callers. Exploitation would require a crafted write operation that exceeds the node's pivot boundaries [2].

Impact

An out-of-bounds access on the pivot array could lead to memory corruption, information disclosure, or system instability. Since the maple tree is used for memory management, any corruption could have wide-ranging effects on system security and stability [1].

Mitigation

The fix has been applied in stable kernel branches (as seen in commits [1] and [2]). Users are advised to update their kernels to the latest stable release that includes this patch. No workarounds are available other than applying the fix.