{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54132", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.522Z", "datePublished": "2025-12-24T13:06:49.030Z", "dateUpdated": "2026-08-05T09:17:32.148Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:32.148Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: stop parsing non-compact HEAD index if clusterofs is invalid\n\nSyzbot generated a crafted image [1] with a non-compact HEAD index of\nclusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,\nwhich causes the following unexpected behavior as below:\n\n BUG: unable to handle page fault for address: fffff52101a3fff9\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 23ffed067 P4D 23ffed067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP KASAN\n CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023\n Workqueue: erofs_worker z_erofs_decompressqueue_work\n RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40\n ...\n Call Trace:\n \n z_erofs_decompressqueue_work+0x99/0xe0\n process_one_work+0x8f6/0x1170\n worker_thread+0xa63/0x1210\n kthread+0x270/0x300\n ret_from_fork+0x1f/0x30\n\nNote that normal images or images using compact indexes are not\nimpacted. Let's fix this now.\n\n[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered by parsing a crafted EROFS on-disk compression index, which requires the malicious image to be mounted on the local system (block device, loop device, or fscache-backed layer); the kernel never processes this data directly from a network protocol.\nAC:L - The clusterofs field is fully attacker-controlled in the image and the corrupted mapping is deterministically consumed on the first read of the crafted file; there is no race, timing, or memory-layout condition outside the attacker's control.\nPR:N - The attacker only needs to supply the crafted EROFS image (USB media, container/OCI layer, downloaded partition image) and requires no account or privilege on the target; the mount itself is performed by the victim's privileged user or automounter.\nUI:R - A user or an automount/container-runtime daemon must mount the attacker-supplied EROFS image, since erofs lacks FS_USERNS_MOUNT and cannot be mounted by the attacker directly; after mounting, any read of the crafted file triggers the bug with no further interaction.\nS:U - The out-of-bounds read and write occur in kernel memory within the same security authority as the kernel filesystem code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrapped page index causes z_erofs_fill_other_copies() to kmap an out-of-bounds pointer and memcpy wild kernel memory into a page that is returned to userspace, giving an arbitrary kernel-memory disclosure primitive.\nI:H - When the out-of-bounds slot reads as NULL, z_erofs_do_decompressed_bvec() writes a valid struct page pointer to an attacker-influenced index far past the decompressed_pages array — an OOB write onto the erofs worker's kernel stack or adjacent heap, which is exploitable for control-flow corruption.\nA:H - The syzbot reproducer shows an unhandled page fault and oops in z_erofs_decompress_queue running in the erofs_worker kthread, and the OOB write reliably corrupts kernel memory, causing a panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zmap.c" ], "versions": [ { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "880c79bdb002b9d5b6940e52c2ad3829c2178207", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "7a4579cd6e4936de107c82499c3c9ee11b63401e", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "060fecf1114ff9fcfe87953fe8c4fc5048777160", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "7ee7a86e28ce9ead7112286c388df8d254c373c6", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "f01b2894928affa3339d355608713cf3db8360b8", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "96a845419b3722869f09883319de4d55c44d9aef", "status": "affected", "versionType": "git" }, { "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d", "lessThan": "cc4efd3dd2ac9f89143e5d881609747ecff04164", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zmap.c" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.243", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.180", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.111", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.28", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.15", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.2", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.243" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.28" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.2.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.3.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/880c79bdb002b9d5b6940e52c2ad3829c2178207" }, { "url": "https://git.kernel.org/stable/c/7a4579cd6e4936de107c82499c3c9ee11b63401e" }, { "url": "https://git.kernel.org/stable/c/060fecf1114ff9fcfe87953fe8c4fc5048777160" }, { "url": "https://git.kernel.org/stable/c/7ee7a86e28ce9ead7112286c388df8d254c373c6" }, { "url": "https://git.kernel.org/stable/c/f01b2894928affa3339d355608713cf3db8360b8" }, { "url": "https://git.kernel.org/stable/c/96a845419b3722869f09883319de4d55c44d9aef" }, { "url": "https://git.kernel.org/stable/c/cc4efd3dd2ac9f89143e5d881609747ecff04164" } ], "title": "erofs: stop parsing non-compact HEAD index if clusterofs is invalid", "x_generator": { "engine": "bippy-1.2.0" } } } }