Executive brief
A vulnerability exists in the Linux kernel's ext4 file system, which is widely used for data storage on Linux-based servers and devices. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. The issue occurs during specific file operations that manage how data is organized on the disk, leading to memory corruption.
Technical details
A use-after-free (UAF) vulnerability exists in fs/ext4/extents_status.c within the ext4_es_insert_extent function. The root cause is a race or logic error where an extent status structure (es1) is freed during a merge operation (via ext4_es_try_to_merge_right) but is subsequently accessed to check its length. An attacker with local user privileges can trigger this by performing specific file operations, such as fallocate or zero_range, which manipulate the extents status tree. This can result in a kernel panic (DoS) or potentially arbitrary code execution in kernel mode. The issue was fixed in kernel version 6.5.4 by reordering checks to ensure pointers are validated immediately after potential freeing events.
Affected products
- Linux Linux Kernel before 6.5.4
Timeline
- 2023-08-13: disclosed: Vulnerability reported via LKML with KASAN logs and reproducer.
- 2023-09-16: patched: Fix committed to the Linux kernel mainline.
- 2023-09-19: patched: Linux kernel 6.5.4 released containing the fix.
- 2023-10-16: advisory: CVE-2023-45898 published in the NVD.
References
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4
- https://github.com/torvalds/linux/commit/768d612f79822d30a1e7d132a4d4b05337ce42ec
- https://lkml.org/lkml/2023/8/13/477
- https://lore.kernel.org/lkml/aa03f191-445c-0d2e-d6d7-0a3208d7df7a%40huawei.com/T/
- https://www.spinics.net/lists/stable-commits/msg317086.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html