CVE-2023-53503

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4_get_group_info() to fail Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attaker (or fuzzer) modifies the superblock via the block device while it is the file system is mounted, it is possible for s_first_data_block to get set to a very large number. In that case, when calculating the block group of some block number (such as the starting block of a preallocation region), could result in an underflow and very large block group number. Then the BUG_ON check in ext4_get_group_info() would fire, resutling in a denial of service attack that can be triggered by root or someone with write access to the block device. For a quality of implementation perspective, it's best that even if the system administrator does something that they shouldn't, that it will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info() will call ext4_error and return NULL. We also add fallback code in all of the callers of ext4_get_group_info() that it might NULL. Also, since ext4_get_group_info() was already borderline to be an inline function, un-inline it. The results in a next reduction of the compiled text size of ext4 by roughly 2k.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067 ↗
• https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302 ↗
• https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed ↗
• https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa ↗
• https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f ↗