PT-2025-40210 · Ext4+2 · Ext4+2

Published 2023-04-29 · Updated 2025-10-02 · CVE-2023-53503

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the ext4 filesystem implementation. Specifically, the ext4 get group info() function previously triggered a kernel BUG when encountering an invalid group number, potentially leading to a denial of service. This condition could be induced by modifying the superblock via the block device while the filesystem is mounted, resulting in an underflow and a large block group number. The function has been modified to return NULL instead of triggering a BUG, and callers have been updated to handle this possibility. The function was also un-inlined to reduce compiled text size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

NULL Pointer Dereference

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-404

CWE-476

CWE-191

CWE-787

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

BDU:2025-12822

CVE-2023-53503

RHSA-2024:10771

RHSA-2024:9315

RHSA-2024_9315

Affected Products

Linux Kernel

Red Hat

Ext4

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53503.json · Exploit
• https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53503 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12822 · Security Note
• https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067 · Patch
• https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302 · Patch
• https://osv.dev/vulnerability/CVE-2023-53503 · Vendor Advisory
• https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa · Patch
• https://cve.org/CVERecord?id=CVE-2023-53503 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53503 · Security Note
• https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f · Patch
• https://ubuntu.com/security/CVE-2023-53503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53503 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53503 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53503 · Vendor Advisory