GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52705 (GCVE-0-2023-52705)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:22 – Updated: 2026-05-11 19:32
VLAI
Title
nilfs2: fix underflow in second superblock position calculations
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix underflow in second superblock position calculations Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second superblock, underflows when the argument device size is less than 4096 bytes. Therefore, when using this macro, it is necessary to check in advance that the device size is not less than a lower limit, or at least that underflow does not occur. The current nilfs2 implementation lacks this check, causing out-of-bound block access when mounting devices smaller than 4096 bytes: I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 NILFS (loop0): unable to read secondary superblock (blocksize = 1024) In addition, when trying to resize the filesystem to a size below 4096 bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number of segments to nilfs_sufile_resize(), corrupting parameters such as the number of segments in superblocks. This causes excessive loop iterations in nilfs_sufile_resize() during a subsequent resize ioctl, causing semaphore ns_segctor_sem to block for a long time and hang the writer thread: INFO: task segctord:5067 blocked for more than 143 seconds. Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:segctord state:D stack:23456 pid:5067 ppid:2 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x1409/0x43f0 kernel/sched/core.c:6606 schedule+0xc3/0x190 kernel/sched/core.c:6682 rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190 nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline] nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570 kthread+0x270/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK> ... Call Trace: <TASK> folio_mark_accessed+0x51c/0xf00 mm/swap.c:515 __nilfs_get_page_block fs/nilfs2/page.c:42 [inline] nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61 nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121 nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176 nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251 nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline] nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline] nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777 nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422 nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline] nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301 ... This fixes these issues by inserting appropriate minimum device size checks or anti-underflow checks, depending on where the macro is used.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-21 17:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 2f7a1135b202977b82457adde7db6c390056863b (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < b96591e2c35c8b47db0ec816b5fc6cb8868000ff (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 52844d8382cd9166d708032def8905ffc3ae550f (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 0ee5ed0126a2211f7174492da2ca2c29f43755c5 (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < a158782b56b070485d54d25fc9aaf2c8f3752205 (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < a8ef5109f93cea9933bbac0455d8c18757b3fcb4 (git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 99b9402a36f0799f25feee4465bfa4b8dfa74b4d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 4.14.306 , ≤ 4.14.* (semver)
Unaffected: 4.19.273 , ≤ 4.19.* (semver)
Unaffected: 5.4.232 , ≤ 5.4.* (semver)
Unaffected: 5.10.169 , ≤ 5.10.* (semver)
Unaffected: 5.15.95 , ≤ 5.15.* (semver)
Unaffected: 6.1.13 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T17:32:06.834863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:07.362Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:34.922Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/ioctl.c",
            "fs/nilfs2/super.c",
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f7a1135b202977b82457adde7db6c390056863b",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "b96591e2c35c8b47db0ec816b5fc6cb8868000ff",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "52844d8382cd9166d708032def8905ffc3ae550f",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "0ee5ed0126a2211f7174492da2ca2c29f43755c5",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "a158782b56b070485d54d25fc9aaf2c8f3752205",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "a8ef5109f93cea9933bbac0455d8c18757b3fcb4",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "99b9402a36f0799f25feee4465bfa4b8dfa74b4d",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/ioctl.c",
            "fs/nilfs2/super.c",
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.232",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.306",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.273",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.232",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.169",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.95",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix underflow in second superblock position calculations\n\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\nsuperblock, underflows when the argument device size is less than 4096\nbytes.  Therefore, when using this macro, it is necessary to check in\nadvance that the device size is not less than a lower limit, or at least\nthat underflow does not occur.\n\nThe current nilfs2 implementation lacks this check, causing out-of-bound\nblock access when mounting devices smaller than 4096 bytes:\n\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\n phys_seg 1 prio class 2\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\n\nIn addition, when trying to resize the filesystem to a size below 4096\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\nnumber of segments in superblocks.  This causes excessive loop iterations\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\nsemaphore ns_segctor_sem to block for a long time and hang the writer\nthread:\n\n INFO: task segctord:5067 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:segctord        state:D stack:23456 pid:5067  ppid:2\n flags:0x00004000\n Call Trace:\n  \u003cTASK\u003e\n  context_switch kernel/sched/core.c:5293 [inline]\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\n  kthread+0x270/0x300 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n  \u003c/TASK\u003e\n ...\n Call Trace:\n  \u003cTASK\u003e\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\n  ...\n\nThis fixes these issues by inserting appropriate minimum device size\nchecks or anti-underflow checks, depending on where the macro is used."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:32:03.567Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d"
        }
      ],
      "title": "nilfs2: fix underflow in second superblock position calculations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52705",
    "datePublished": "2024-05-21T15:22:54.015Z",
    "dateReserved": "2024-03-07T14:49:46.891Z",
    "dateUpdated": "2026-05-11T19:32:03.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52705",
      "date": "2026-09-13",
      "epss": "0.00252",
      "percentile": "0.16633"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52705\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:12.840\",\"lastModified\":\"2026-06-17T06:43:23.430\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix underflow in second superblock position calculations\\n\\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\\nsuperblock, underflows when the argument device size is less than 4096\\nbytes.  Therefore, when using this macro, it is necessary to check in\\nadvance that the device size is not less than a lower limit, or at least\\nthat underflow does not occur.\\n\\nThe current nilfs2 implementation lacks this check, causing out-of-bound\\nblock access when mounting devices smaller than 4096 bytes:\\n\\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\\n phys_seg 1 prio class 2\\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\\n\\nIn addition, when trying to resize the filesystem to a size below 4096\\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\\nnumber of segments in superblocks.  This causes excessive loop iterations\\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\\nsemaphore ns_segctor_sem to block for a long time and hang the writer\\nthread:\\n\\n INFO: task segctord:5067 blocked for more than 143 seconds.\\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\\n \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n task:segctord        state:D stack:23456 pid:5067  ppid:2\\n flags:0x00004000\\n Call Trace:\\n  \u003cTASK\u003e\\n  context_switch kernel/sched/core.c:5293 [inline]\\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\\n  kthread+0x270/0x300 kernel/kthread.c:376\\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\\n  \u003c/TASK\u003e\\n ...\\n Call Trace:\\n  \u003cTASK\u003e\\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\\n  ...\\n\\nThis fixes these issues by inserting appropriate minimum device size\\nchecks or anti-underflow checks, depending on where the macro is used.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corrige el desbordamiento en los c\u00e1lculos de la posici\u00f3n del segundo superbloque. La macro NILFS_SB2_OFFSET_BYTES, que calcula la posici\u00f3n del segundo superbloque, sufre un desbordamiento cuando el tama\u00f1o del dispositivo del argumento es inferior a 4096 bytes. Por lo tanto, al utilizar esta macro, es necesario comprobar de antemano que el tama\u00f1o del dispositivo no sea inferior a un l\u00edmite inferior, o al menos que no se produzca un desbordamiento insuficiente. La implementaci\u00f3n actual de nilfs2 carece de esta verificaci\u00f3n, lo que provoca un acceso a bloques fuera de los l\u00edmites al montar dispositivos de menos de 4096 bytes: error de E/S, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 NILFS (loop0 ): no se puede leer el superbloque secundario (tama\u00f1o de bloque = 1024) Adem\u00e1s, al intentar cambiar el tama\u00f1o del sistema de archivos a un tama\u00f1o inferior a 4096 bytes, este desbordamiento se produce en nilfs_resize_fs(), pasando una gran cantidad de segmentos a nilfs_sufile_resize(), corrompiendo par\u00e1metros como como el n\u00famero de segmentos en supermanzanas. Esto provoca iteraciones de bucle excesivas en nilfs_sufile_resize() durante un cambio de tama\u00f1o de ioctl posterior, lo que provoca que el sem\u00e1foro ns_segctor_sem se bloquee durante mucho tiempo y cuelgue el hilo de escritura: INFORMACI\u00d3N: tarea segctord:5067 bloqueada durante m\u00e1s de 143 segundos. No contaminado 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0 \\\"echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\\\" desactiva este mensaje. tarea:segctord estado:D pila:23456 pid:5067 ppid:2 banderas:0x00004000 Seguimiento de llamadas:  context_switch kernel/sched/core.c:5293 [en l\u00ednea] __schedule+0x1409/0x43f0 kernel/sched/core.c: 6606 programaci\u00f3n+0xc3/0x190 kernel/sched/core.c:6682 rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190 nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs /nilfs2/segmento. c:2486 [en l\u00ednea] nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570 kthread+0x270/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 ... Seguimiento de llamadas:  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515 __nilfs_get_page_block fs/nilfs2/page.c:42 [en l\u00ednea] nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61 nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121 nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176 nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251 _get_segment_usage_block fs/nilfs2/sufile.c :92 [en l\u00ednea] nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [en l\u00ednea] nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777 nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422 nilfs_ioctl_resize f s/nilfs2 /ioctl.c:1033 [en l\u00ednea] nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301 ... Esto soluciona estos problemas insertando comprobaciones de tama\u00f1o m\u00ednimo de dispositivo adecuadas o comprobaciones anti-desbordamiento, dependiendo de d\u00f3nde se utilice la macro .\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nilfs2/ioctl.c\",\"fs/nilfs2/super.c\",\"fs/nilfs2/the_nilfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"2f7a1135b202977b82457adde7db6c390056863b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"b96591e2c35c8b47db0ec816b5fc6cb8868000ff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"52844d8382cd9166d708032def8905ffc3ae550f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"0ee5ed0126a2211f7174492da2ca2c29f43755c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"a158782b56b070485d54d25fc9aaf2c8f3752205\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"a8ef5109f93cea9933bbac0455d8c18757b3fcb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e339ad31f59925b48a92ee3947692fdf9758b8c7\",\"lessThan\":\"99b9402a36f0799f25feee4465bfa4b8dfa74b4d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nilfs2/ioctl.c\",\"fs/nilfs2/super.c\",\"fs/nilfs2/the_nilfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.306\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.273\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.232\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.169\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.95\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.13\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-21T17:32:06.834863Z\",\"id\":\"CVE-2023-52705\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.306\",\"matchCriteriaId\":\"C3601A65-E0A1-4B9E-9AE3-31871BA7A14B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.273\",\"matchCriteriaId\":\"FC86F278-A337-4A8A-A7BB-758898345802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.232\",\"matchCriteriaId\":\"9C6E0696-3702-4B0C-A102-2753BDC8C3D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.169\",\"matchCriteriaId\":\"D8E6784B-A00F-47F0-882B-7209E1F374B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.95\",\"matchCriteriaId\":\"8508F80E-8588-4976-A2BA-7A2D85018C4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.13\",\"matchCriteriaId\":\"CE354BE6-0C0F-47EB-AD8A-1433F041AC20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D34127CC-68F5-4703-A5F6-5006F803E4AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C64BDD9D-C663-4E75-AE06-356EDC392B82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"26544390-88E4-41CA-98BF-7BB1E9D4E243\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:09:07+00:00",
      "cve": "CVE-2023-52705",
      "id": "CVE-2023-52705",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nilfs2: fix underflow in second superblock position calculations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52705.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:34.922Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52705\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T17:32:06.834863Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.283Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"nilfs2: fix underflow in second superblock position calculations\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"2f7a1135b202977b82457adde7db6c390056863b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"b96591e2c35c8b47db0ec816b5fc6cb8868000ff\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"52844d8382cd9166d708032def8905ffc3ae550f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"0ee5ed0126a2211f7174492da2ca2c29f43755c5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"a158782b56b070485d54d25fc9aaf2c8f3752205\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"a8ef5109f93cea9933bbac0455d8c18757b3fcb4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e339ad31f59925b48a92ee3947692fdf9758b8c7\", \"lessThan\": \"99b9402a36f0799f25feee4465bfa4b8dfa74b4d\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nilfs2/ioctl.c\", \"fs/nilfs2/super.c\", \"fs/nilfs2/the_nilfs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.306\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.273\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.232\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.169\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nilfs2/ioctl.c\", \"fs/nilfs2/super.c\", \"fs/nilfs2/the_nilfs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b\"}, {\"url\": \"https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff\"}, {\"url\": \"https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f\"}, {\"url\": \"https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5\"}, {\"url\": \"https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205\"}, {\"url\": \"https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4\"}, {\"url\": \"https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix underflow in second superblock position calculations\\n\\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\\nsuperblock, underflows when the argument device size is less than 4096\\nbytes.  Therefore, when using this macro, it is necessary to check in\\nadvance that the device size is not less than a lower limit, or at least\\nthat underflow does not occur.\\n\\nThe current nilfs2 implementation lacks this check, causing out-of-bound\\nblock access when mounting devices smaller than 4096 bytes:\\n\\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\\n phys_seg 1 prio class 2\\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\\n\\nIn addition, when trying to resize the filesystem to a size below 4096\\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\\nnumber of segments in superblocks.  This causes excessive loop iterations\\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\\nsemaphore ns_segctor_sem to block for a long time and hang the writer\\nthread:\\n\\n INFO: task segctord:5067 blocked for more than 143 seconds.\\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\\n \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n task:segctord        state:D stack:23456 pid:5067  ppid:2\\n flags:0x00004000\\n Call Trace:\\n  \u003cTASK\u003e\\n  context_switch kernel/sched/core.c:5293 [inline]\\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\\n  kthread+0x270/0x300 kernel/kthread.c:376\\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\\n  \u003c/TASK\u003e\\n ...\\n Call Trace:\\n  \u003cTASK\u003e\\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\\n  ...\\n\\nThis fixes these issues by inserting appropriate minimum device size\\nchecks or anti-underflow checks, depending on where the macro is used.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.306\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.273\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.232\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.169\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.95\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.13\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:17:00.936Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52705\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:17:00.936Z\", \"dateReserved\": \"2024-03-07T14:49:46.891Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:22:54.015Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.