CVE-2023-54305

Root

Cause

The vulnerability resides in the ext4 filesystem's extended attribute (ea) block expansion code. During unmount, the s_root pointer in the superblock is set to NULL. However, the ea block expansion routine accesses s_root without a NULL check, leading to a NULL pointer dereference and kernel panic.

Exploitation

Exploitation requires triggering an ea block expansion while the filesystem is in the process of being unmounted. An attacker with local access could cause this condition if a process holds an open file descriptor with extended attributes and the unmount is initiated concurrently, creating a race window. No special privileges beyond local access are needed.

Impact

Successful exploitation results in a denial of service (system crash) due to a kernel panic. There is no evidence of privilege escalation or data corruption.

Mitigation

The fix is to refuse the creation of ea blocks when the filesystem is unmounted. Patches have been applied to the stable kernel tree (references [1], [2], [3]). Users should update to a kernel version containing the fix.