CVE-2023-53526 jbd2: check 'jh->b_transaction' before removing it from checkpoint

In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh-btransaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1: jbd2journalcommittransaction jbd2journalinsertcheckpointjh, committransaction // Put jh into trans1-tcheckpointli...

CVE-2023-53526

CVE-2023-53526 affects the Linux kernel’s journaling subsystem (jbd2) and can lead to ext4 image corruption if a journal checkpoint is removed during a power outage. The described attack path involves a sequence where a transaction is inserted into the checkpoint list, buffers are manipulated, an...

CVE-2023-53503

In the Linux kernel, the vulnerability CVE-2023-53503 affects ext4: ext4_get_group_info() could underflow when computing a block group if s_first_data_block is set to an extremely large value due to a malicious attacker with write access to the block device while the filesystem is mounted. This c...

CVE-2023-53503 ext4: allow ext4_get_group_info() to fail

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4getgroupinfo to fail Previously, ext4getgroupinfo would treat an invalid group number as BUG, since in theory it should never happen. However, if a malicious attaker or fuzzer modifies the superblock via the block...

CVE-2023-53503 ext4: allow ext4_get_group_info() to fail

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4getgroupinfo to fail Previously, ext4getgroupinfo would treat an invalid group number as BUG, since in theory it should never happen. However, if a malicious attaker or fuzzer modifies the superblock via the block...

CVE-2022-50465 ext4: fix leaking uninitialized memory in fast-commit journal

In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk...

CVE-2022-50465 ext4: fix leaking uninitialized memory in fast-commit journal

In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk...

CVE-2023-53473 ext4: improve error handling from ext4_dirhash()

In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4dirhash The ext4dirhash will almost never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that...

CVE-2023-53473 ext4: improve error handling from ext4_dirhash()

In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4dirhash The ext4dirhash will almost never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that...

CVE-2023-53450

The CVE-2023-53450 entry concerns the Linux kernel ext4 subsystem. A malicious fuzzer that overwrites the ext4 superblock while mounted can set s_first_data_block to a very large value, causing the block-group calculation to underflow and trigger a BUG_ON. The fix changes the BUG_ON to ext4_warni...

CVE-2023-53450 ext4: remove a BUG_ON in ext4_mb_release_group_pa()

In the Linux kernel, the following vulnerability has been resolved: ext4: remove a BUGON in ext4mbreleasegrouppa If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the sfirstdatablock is set to a very large number, the calculation of the block group can underflow,...

CVE-2023-53450 ext4: remove a BUG_ON in ext4_mb_release_group_pa()

In the Linux kernel, the following vulnerability has been resolved: ext4: remove a BUGON in ext4mbreleasegrouppa If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the sfirstdatablock is set to a very large number, the calculation of the block group can underflow,...

CVE-2022-50436 ext4: don't set up encryption key during jbd2 transaction

In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 "ext4: fixup ext4fctrack functions' signature" extended the scope of the transaction in ext4unlink too far, making it include the call to ext4findentry...

CVE-2022-50436 ext4: don't set up encryption key during jbd2 transaction

In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 "ext4: fixup ext4fctrack functions' signature" extended the scope of the transaction in ext4unlink too far, making it include the call to ext4findentry...

CVE-2022-50436

CVE-2022-50436 : Linux kernel ext4 had a deadlock risk when ext4_unlink() extended the jbd2 transaction scope, because ext4_find_entry() could require setting up the directory encryption key inside a transaction. The fix restores the transaction to its original scope, preventing the deadlock. The...

CVE-2022-50435 ext4: avoid crash when inline data creation follows DIO write

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4STATEMAYINLINEDATA flag. Thus when inode gets truncated later to say 1 byte and...

CVE-2022-50435

CVE-2022-50435 : Linux kernel ext4 inline data handling bug where inline data was not cleared after direct IO creation, potentially causing a crash when an inode with both inline and block data is later truncated and rewritten. The accompanying fixes clear EXT4_STATE_MAY_INLINE_DATA during direct...

CVE-2022-50435 ext4: avoid crash when inline data creation follows DIO write

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4STATEMAYINLINEDATA flag. Thus when inode gets truncated later to say 1 byte and...

CVE-2022-50428 ext4: fix off-by-one errors in fast-commit block filling

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one errors in fast-commit block filling Due to several different off-by-one errors, or perhaps due to a late change in design that wasn't fully reflected in the code that was actually merged, there are several ve...

CVE-2022-50428 ext4: fix off-by-one errors in fast-commit block filling

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one errors in fast-commit block filling Due to several different off-by-one errors, or perhaps due to a late change in design that wasn't fully reflected in the code that was actually merged, there are several ve...