CVE-2023-53763 (GCVE-0-2023-53763)

Vulnerability from cvelistv5 – Published: 2025-12-08 01:19 – Updated: 2026-08-05 09:15
VLAI
Title
Revert "f2fs: fix to do sanity check on extent cache correctly"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 inline_data_addr fs/f2fs/f2fs.h:3275 [inline] __recover_inline_status fs/f2fs/inode.c:113 [inline] do_read_inode fs/f2fs/inode.c:480 [inline] f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 mount_bdev+0x276/0x3b0 fs/super.c:1391 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_sys_mount fs/namespace.c:3884 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue was bisected to: commit d48a7b3a72f121655d95b5157c32c7d555e44c05 Author: Chao Yu <chao@kernel.org> Date: Mon Jan 9 03:49:20 2023 +0000 f2fs: fix to do sanity check on extent cache correctly The root cause is we applied both v1 and v2 of the patch, v2 is the right fix, so it needs to revert v1 in order to fix reported issue. v1: commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ v2: commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 85eb8b61dd4cfc7a839a0e86287b92ca6193444e , < 0d545a8e77cbd1fbad311b18952e38e0f7672ab4 (git)
Affected: d48a7b3a72f121655d95b5157c32c7d555e44c05 , < ea35767edc78327c686e21fe1231b668f11be0db (git)
Affected: d48a7b3a72f121655d95b5157c32c7d555e44c05 , < bbb3cd66301ef752fae2922452660f228d69bcaf (git)
Affected: d48a7b3a72f121655d95b5157c32c7d555e44c05 , < 958ccbbf1ce716d77c7cfa79ace50a421c1eed73 (git)
Affected: a3d1fd01250ffca88c11e9bd8d19be779acc7557 (git)
Affected: 6.1.29 , < 6.1.53 (semver)
Affected: 6.2.5 , < 6.3 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.1.53 , ≤ 6.1.* (semver)
Unaffected: 6.4.16 , ≤ 6.4.* (semver)
Unaffected: 6.5.3 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d545a8e77cbd1fbad311b18952e38e0f7672ab4",
              "status": "affected",
              "version": "85eb8b61dd4cfc7a839a0e86287b92ca6193444e",
              "versionType": "git"
            },
            {
              "lessThan": "ea35767edc78327c686e21fe1231b668f11be0db",
              "status": "affected",
              "version": "d48a7b3a72f121655d95b5157c32c7d555e44c05",
              "versionType": "git"
            },
            {
              "lessThan": "bbb3cd66301ef752fae2922452660f228d69bcaf",
              "status": "affected",
              "version": "d48a7b3a72f121655d95b5157c32c7d555e44c05",
              "versionType": "git"
            },
            {
              "lessThan": "958ccbbf1ce716d77c7cfa79ace50a421c1eed73",
              "status": "affected",
              "version": "d48a7b3a72f121655d95b5157c32c7d555e44c05",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3d1fd01250ffca88c11e9bd8d19be779acc7557",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.53",
              "status": "affected",
              "version": "6.1.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "6.1.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"f2fs: fix to do sanity check on extent cache correctly\"\n\nsyzbot reports a f2fs bug as below:\n\nUBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19\nindex 1409 is out of range for type \u0027__le32[923]\u0027 (aka \u0027unsigned int[923]\u0027)\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n inline_data_addr fs/f2fs/f2fs.h:3275 [inline]\n __recover_inline_status fs/f2fs/inode.c:113 [inline]\n do_read_inode fs/f2fs/inode.c:480 [inline]\n f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604\n f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601\n mount_bdev+0x276/0x3b0 fs/super.c:1391\n legacy_get_tree+0xef/0x190 fs/fs_context.c:611\n vfs_get_tree+0x8c/0x270 fs/super.c:1519\n do_new_mount+0x28f/0xae0 fs/namespace.c:3335\n do_mount fs/namespace.c:3675 [inline]\n __do_sys_mount fs/namespace.c:3884 [inline]\n __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe issue was bisected to:\n\ncommit d48a7b3a72f121655d95b5157c32c7d555e44c05\nAuthor: Chao Yu \u003cchao@kernel.org\u003e\nDate:   Mon Jan 9 03:49:20 2023 +0000\n\n    f2fs: fix to do sanity check on extent cache correctly\n\nThe root cause is we applied both v1 and v2 of the patch, v2 is the right\nfix, so it needs to revert v1 in order to fix reported issue.\n\nv1:\ncommit d48a7b3a72f1 (\"f2fs: fix to do sanity check on extent cache correctly\")\nhttps://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/\n\nv2:\ncommit 269d11948100 (\"f2fs: fix to do sanity check on extent cache correctly\")\nhttps://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through `mount()`/`f2fs_fill_super()` and subsequent `f2fs_iget()` lookups on a crafted f2fs image, which requires local system access \u2014 an attacker attaches a loop device or removable medium and lets it be mounted. There is no network- or remote-peer-reachable path into `do_read_inode()`.\nAC:L - Every input driving the out-of-bounds access \u2014 `ri-\u003ei_extra_isize`, `ri-\u003ei_inline_xattr_size`, `i_inline` flags and `i_mode` \u2014 is a raw on-disk field the attacker writes into the image, so the OOB index is chosen exactly and the fault is deterministic on every mount, with no race or memory-layout condition outside the attacker\u0027s control.\nPR:L - A basic unprivileged local account suffices in the realistic deployment: on Android (where f2fs is the userdata/adoptable-storage filesystem) vold auto-mounts attacker-supplied f2fs media, and on desktops/kiosks udisks2 mounts removable media on behalf of the logged-in user, so no CAP_SYS_ADMIN of the attacker\u0027s own is needed.\nUI:N - The attacker attaches the crafted image and the automounter mounts it, then the attacker itself stats or reads the crafted inode; no action by any separate victim user is required at any point.\nS:U - The out-of-bounds reads and the corrupt inode state stay entirely inside the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, container or sandbox boundary.\nC:H - `__get_inode_rdev()` and `__written_first_block()` read `ri-\u003ei_addr[extra_size]` with `extra_size` up to 16383, i.e. an attacker-selected 4-byte word up to roughly 62 KiB past the end of the 4 KiB node page \u2014 an unbounded, repeatable kernel out-of-bounds read primitive over adjacent page-allocator memory rather than a few bounded bytes.\nI:H - The unvalidated inode page is marked dirty via `set_page_dirty()` in the cold-bit recovery and `__recover_inline_status()` paths before the corruption is ever detected, writing unvalidated metadata back to the device, and the out-of-bounds values are folded into `inode-\u003ei_rdev` and the `FI_FIRST_BLOCK_WRITTEN` decision, so attacker-influenced foreign kernel memory drives in-kernel state.\nA:H - The condition is a reported UBSAN array-index-out-of-bounds; on kernels built with `CONFIG_UBSAN_TRAP` (standard in Android GKI, the main f2fs deployment) it traps into an immediate panic, and the ~62 KiB out-of-bounds read oopses under KASAN, `DEBUG_PAGEALLOC`, or when it walks into an unmapped region, giving a reliable, repeatable crash from a single mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:53.254Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d545a8e77cbd1fbad311b18952e38e0f7672ab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea35767edc78327c686e21fe1231b668f11be0db"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbb3cd66301ef752fae2922452660f228d69bcaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/958ccbbf1ce716d77c7cfa79ace50a421c1eed73"
        }
      ],
      "title": "Revert \"f2fs: fix to do sanity check on extent cache correctly\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53763",
    "datePublished": "2025-12-08T01:19:25.250Z",
    "dateReserved": "2025-12-08T01:18:04.281Z",
    "dateUpdated": "2026-08-05T09:15:53.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53763",
      "date": "2026-08-05",
      "epss": "0.00139",
      "percentile": "0.03723"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53763\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-08T02:15:52.173\",\"lastModified\":\"2026-06-17T06:46:01.660\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"f2fs: fix to do sanity check on extent cache correctly\\\"\\n\\nsyzbot reports a f2fs bug as below:\\n\\nUBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19\\nindex 1409 is out of range for type \u0027__le32[923]\u0027 (aka \u0027unsigned int[923]\u0027)\\nCall Trace:\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\\n ubsan_epilogue lib/ubsan.c:217 [inline]\\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\\n inline_data_addr fs/f2fs/f2fs.h:3275 [inline]\\n __recover_inline_status fs/f2fs/inode.c:113 [inline]\\n do_read_inode fs/f2fs/inode.c:480 [inline]\\n f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604\\n f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601\\n mount_bdev+0x276/0x3b0 fs/super.c:1391\\n legacy_get_tree+0xef/0x190 fs/fs_context.c:611\\n vfs_get_tree+0x8c/0x270 fs/super.c:1519\\n do_new_mount+0x28f/0xae0 fs/namespace.c:3335\\n do_mount fs/namespace.c:3675 [inline]\\n __do_sys_mount fs/namespace.c:3884 [inline]\\n __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nThe issue was bisected to:\\n\\ncommit d48a7b3a72f121655d95b5157c32c7d555e44c05\\nAuthor: Chao Yu \u003cchao@kernel.org\u003e\\nDate:   Mon Jan 9 03:49:20 2023 +0000\\n\\n    f2fs: fix to do sanity check on extent cache correctly\\n\\nThe root cause is we applied both v1 and v2 of the patch, v2 is the right\\nfix, so it needs to revert v1 in order to fix reported issue.\\n\\nv1:\\ncommit d48a7b3a72f1 (\\\"f2fs: fix to do sanity check on extent cache correctly\\\")\\nhttps://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/\\n\\nv2:\\ncommit 269d11948100 (\\\"f2fs: fix to do sanity check on extent cache correctly\\\")\\nhttps://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"85eb8b61dd4cfc7a839a0e86287b92ca6193444e\",\"lessThan\":\"0d545a8e77cbd1fbad311b18952e38e0f7672ab4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d48a7b3a72f121655d95b5157c32c7d555e44c05\",\"lessThan\":\"ea35767edc78327c686e21fe1231b668f11be0db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d48a7b3a72f121655d95b5157c32c7d555e44c05\",\"lessThan\":\"bbb3cd66301ef752fae2922452660f228d69bcaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d48a7b3a72f121655d95b5157c32c7d555e44c05\",\"lessThan\":\"958ccbbf1ce716d77c7cfa79ace50a421c1eed73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d1fd01250ffca88c11e9bd8d19be779acc7557\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.29\",\"lessThan\":\"6.1.53\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.2.5\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.53\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.16\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.3\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d545a8e77cbd1fbad311b18952e38e0f7672ab4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/958ccbbf1ce716d77c7cfa79ace50a421c1eed73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bbb3cd66301ef752fae2922452660f228d69bcaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea35767edc78327c686e21fe1231b668f11be0db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:54:43+00:00",
      "cve": "CVE-2023-53763",
      "id": "CVE-2023-53763",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"f2fs: fix to do sanity check on extent cache correctly\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53763.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.