linux-cve-announce - CVE-2023-53503: ext4: allow ext4_get_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100127-CVE-2023-53503-d86c@gregkh>
Date: Wed,  1 Oct 2025 13:45:55 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53503: ext4: allow ext4_get_group_info() to fail

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: allow ext4_get_group_info() to fail

Previously, ext4_get_group_info() would treat an invalid group number
as BUG(), since in theory it should never happen.  However, if a
malicious attaker (or fuzzer) modifies the superblock via the block
device while it is the file system is mounted, it is possible for
s_first_data_block to get set to a very large number.  In that case,
when calculating the block group of some block number (such as the
starting block of a preallocation region), could result in an
underflow and very large block group number.  Then the BUG_ON check in
ext4_get_group_info() would fire, resutling in a denial of service
attack that can be triggered by root or someone with write access to
the block device.

For a quality of implementation perspective, it's best that even if
the system administrator does something that they shouldn't, that it
will not trigger a BUG.  So instead of BUG'ing, ext4_get_group_info()
will call ext4_error and return NULL.  We also add fallback code in
all of the callers of ext4_get_group_info() that it might NULL.

Also, since ext4_get_group_info() was already borderline to be an
inline function, un-inline it.  The results in a next reduction of the
compiled text size of ext4 by roughly 2k.

The Linux kernel CVE team has assigned CVE-2023-53503 to this issue.

Affected and fixed versions
===========================

	Fixed in 5.10.181 with commit 100c0ad6c04597fefeaaba2bb1827cc015d95067
	Fixed in 5.15.113 with commit 620a3c28221bb219b81bc0bffd065cc187494302
	Fixed in 6.1.30 with commit b4319e457d6e3fb33e443efeaf4634fc36e8a9ed
	Fixed in 6.3.4 with commit 31668cebf45adfb6283e465e641c4f5a21b07afa
	Fixed in 6.4 with commit 5354b2af34064a4579be8bc0e2f15a7b70f14b5f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53503
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/balloc.c
	fs/ext4/ext4.h
	fs/ext4/ialloc.c
	fs/ext4/mballoc.c
	fs/ext4/super.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067
	https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302
	https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed
	https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa
	https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f