PT-2023-9426 · Linux+4 · Linux Kernel+4
Published
2023-01-11
·
Updated
2025-09-29
·
CVE-2023-52900
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The vulnerability is related to the nilfs2 component of the Linux kernel. It occurs when nilfs2 reads a corrupted disk image and attempts to read a b-tree node block using an invalid virtual block address. The error code returned in this case is the same as the internal code used by b-tree lookup routines to indicate that a block does not exist, leading to potential misbehavior of functions operating on the b-tree. Specifically, when
nilfs btree insert() receives this spurious 'not found' code from nilfs btree do lookup(), it misunderstands the 'not found' check as successful and continues the insert operation using incomplete lookup path data, causing a crash. The patch fixes this issue by replacing the error code returned by nilfs btree get block() on block address conversion failure from -ENOENT to -EINVAL, indicating corrupted b-tree metadata.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linux Kernel
Red Os
Suse