linux-cve-announce - CVE-2023-54135: maple_tree: fix potential out-of-bounds access in mas_wr_end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122421-CVE-2023-54135-ffa3@gregkh>
Date: Wed, 24 Dec 2025 14:07:32 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54135: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()

Check the write offset end bounds before using it as the offset into the
pivot array.  This avoids a possible out-of-bounds access on the pivot
array if the write extends to the last slot in the node, in which case the
node maximum should be used as the end pivot.

akpm: this doesn't affect any current callers, but new users of mapletree
may encounter this problem if backported into earlier kernels, so let's
fix it in -stable kernels in case of this.

The Linux kernel CVE team has assigned CVE-2023-54135 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.1.37 with commit 4e2ad53ababeaac44d71162650984abfe783960c
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.3.11 with commit dc4751bd4aba01ccfc02f91adfeee0ba4cda405c
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.4.1 with commit f5fcf6555a2a4f32947d17b92b173837cc652891
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.5 with commit cd00dd2585c4158e81fdfac0bbcc0446afbad26d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54135
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	lib/maple_tree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4e2ad53ababeaac44d71162650984abfe783960c
	https://git.kernel.org/stable/c/dc4751bd4aba01ccfc02f91adfeee0ba4cda405c
	https://git.kernel.org/stable/c/f5fcf6555a2a4f32947d17b92b173837cc652891
	https://git.kernel.org/stable/c/cd00dd2585c4158e81fdfac0bbcc0446afbad26d