CVE-2023-54050 (GCVE-0-2023-54050)
Vulnerability from cvelistv5 – Published: 2025-12-24 12:23 – Updated: 2026-08-05 09:16
VLAI
EPSS
VEX
Title
ubifs: Fix memleak when insert_old_idx() failed
Summary
In the Linux kernel, the following vulnerability has been resolved:
ubifs: Fix memleak when insert_old_idx() failed
Following process will cause a memleak for copied up znode:
dirty_cow_znode
zn = copy_znode(c, znode);
err = insert_old_idx(c, zbr->lnum, zbr->offs);
if (unlikely(err))
return ERR_PTR(err); // No one refers to zn.
Fetch a reproducer in [Link].
Function copy_znode() is split into 2 parts: resource allocation
and znode replacement, insert_old_idx() is split in similar way,
so resource cleanup could be done in error handling path without
corrupting metadata(mem & disk).
It's okay that old index inserting is put behind of add_idx_dirt(),
old index is used in layout_leb_in_gaps(), so the two processes do
not depend on each other.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < cc29c7216d7f057eb0613b97dc38c7e1962a88d2
(git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 6f2eee5457bc48b0426dedfd78cdbdea241a6edb (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 66e9f2fb3e753f820bec2a98e8c6387029988320 (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < ef9aac603659e9ffe7d69ae16e3f0fc0991a965b (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 79079cebbeed624b9d01cfcf1e3254ae1a1f6e14 (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < a6da0ab9847779e05a7416c7a98148b549de69ef (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < b5fda08ef213352ac2df7447611eb4d383cce929 (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.27
Unaffected: 0 , < 2.6.27 (semver) Unaffected: 4.19.283 , ≤ 4.19.* (semver) Unaffected: 5.4.243 , ≤ 5.4.* (semver) Unaffected: 5.10.180 , ≤ 5.10.* (semver) Unaffected: 5.15.111 , ≤ 5.15.* (semver) Unaffected: 6.1.28 , ≤ 6.1.* (semver) Unaffected: 6.2.15 , ≤ 6.2.* (semver) Unaffected: 6.3.2 , ≤ 6.3.* (semver) Unaffected: 6.4 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ubifs/tnc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc29c7216d7f057eb0613b97dc38c7e1962a88d2",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "6f2eee5457bc48b0426dedfd78cdbdea241a6edb",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "66e9f2fb3e753f820bec2a98e8c6387029988320",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "ef9aac603659e9ffe7d69ae16e3f0fc0991a965b",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "79079cebbeed624b9d01cfcf1e3254ae1a1f6e14",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "a6da0ab9847779e05a7416c7a98148b549de69ef",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "b5fda08ef213352ac2df7447611eb4d383cce929",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ubifs/tnc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.283",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.243",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix memleak when insert_old_idx() failed\n\nFollowing process will cause a memleak for copied up znode:\n\ndirty_cow_znode\n zn = copy_znode(c, znode);\n err = insert_old_idx(c, zbr-\u003elnum, zbr-\u003eoffs);\n if (unlikely(err))\n return ERR_PTR(err); // No one refers to zn.\n\nFetch a reproducer in [Link].\n\nFunction copy_znode() is split into 2 parts: resource allocation\nand znode replacement, insert_old_idx() is split in similar way,\nso resource cleanup could be done in error handling path without\ncorrupting metadata(mem \u0026 disk).\nIt\u0027s okay that old index inserting is put behind of add_idx_dirt(),\nold index is used in layout_leb_in_gaps(), so the two processes do\nnot depend on each other."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached only through local filesystem syscalls (write/create/unlink/rename/truncate) on a mounted UBIFS volume via ubifs_jnl_* \u2192 ubifs_tnc_add/remove \u2192 lookup_level0_dirty \u2192 dirty_cow_znode. No network protocol handler parses remote data into this code.\nAC:L - Both preconditions are attacker-driven: the COW branch is entered by forcing a commit with fsync/sync while doing metadata work, and the GFP_NOFS allocation failure is produced by deliberately induced memory pressure, which is readily achievable by an unprivileged process on the memory-constrained embedded systems where UBIFS is deployed and which simultaneously activates the shrinker path that turns the corruption into a UAF.\nPR:L - Only an unprivileged local user with write access to any directory on the UBIFS mount is needed; there is no capability, namespace, or admin check anywhere between the syscall entry and dirty_cow_znode.\nUI:N - The attacker triggers everything with their own file operations on an already-mounted filesystem; no victim action, no mount by another user, and no special file is required.\nS:U - The corruption is confined to the kernel\u0027s own TNC structures and the mounted filesystem; there is no crossing into another security authority such as a hypervisor or IOMMU domain.\nC:H - The dangling zbranch[].znode left after shrink_tnc() frees a child through the orphaned parent yields a use-after-free read of a generic kmalloc slab object, letting the attacker read reclaimed kernel memory through TNC descent and, with a sprayed replacement znode, escalate to arbitrary kernel reads.\nI:H - The same use-after-free gives write access to the freed/reallocated znode (flag setting, key_copy, parent re-pointing), a classic control-flow-hijack primitive, and the truncated commit list plus mis-set cparent additionally corrupt the on-disk index \u2014 the commit message itself cites \"corrupting metadata(mem \u0026 disk)\".\nA:H - Beyond the znode memory leak, the orphaned root case NULL-derefs in ubifs_tnc_levelorder_next() and runs off the end of ubifs_destroy_tnc_subtree() (oops at shrink or unmount), and the dirty_zn_cnt/parent assertions in get_znodes_to_commit() force the filesystem read-only or BUG() depending on assert_action."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:16:47.787Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc29c7216d7f057eb0613b97dc38c7e1962a88d2"
},
{
"url": "https://git.kernel.org/stable/c/6f2eee5457bc48b0426dedfd78cdbdea241a6edb"
},
{
"url": "https://git.kernel.org/stable/c/66e9f2fb3e753f820bec2a98e8c6387029988320"
},
{
"url": "https://git.kernel.org/stable/c/3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d"
},
{
"url": "https://git.kernel.org/stable/c/ef9aac603659e9ffe7d69ae16e3f0fc0991a965b"
},
{
"url": "https://git.kernel.org/stable/c/79079cebbeed624b9d01cfcf1e3254ae1a1f6e14"
},
{
"url": "https://git.kernel.org/stable/c/a6da0ab9847779e05a7416c7a98148b549de69ef"
},
{
"url": "https://git.kernel.org/stable/c/b5fda08ef213352ac2df7447611eb4d383cce929"
}
],
"title": "ubifs: Fix memleak when insert_old_idx() failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-54050",
"datePublished": "2025-12-24T12:23:00.366Z",
"dateReserved": "2025-12-24T12:21:05.090Z",
"dateUpdated": "2026-08-05T09:16:47.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-54050",
"date": "2026-11-03",
"epss": "0.00202",
"percentile": "0.10188"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ubifs/tnc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc29c7216d7f057eb0613b97dc38c7e1962a88d2",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "6f2eee5457bc48b0426dedfd78cdbdea241a6edb",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "66e9f2fb3e753f820bec2a98e8c6387029988320",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "ef9aac603659e9ffe7d69ae16e3f0fc0991a965b",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "79079cebbeed624b9d01cfcf1e3254ae1a1f6e14",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "a6da0ab9847779e05a7416c7a98148b549de69ef",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "b5fda08ef213352ac2df7447611eb4d383cce929",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ubifs/tnc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix memleak when insert_old_idx() failed\n\nFollowing process will cause a memleak for copied up znode:\n\ndirty_cow_znode\n zn = copy_znode(c, znode);\n err = insert_old_idx(c, zbr-\u003elnum, zbr-\u003eoffs);\n if (unlikely(err))\n return ERR_PTR(err); // No one refers to zn.\n\nFetch a reproducer in [Link].\n\nFunction copy_znode() is split into 2 parts: resource allocation\nand znode replacement, insert_old_idx() is split in similar way,\nso resource cleanup could be done in error handling path without\ncorrupting metadata(mem \u0026 disk).\nIt\u0027s okay that old index inserting is put behind of add_idx_dirt(),\nold index is used in layout_leb_in_gaps(), so the two processes do\nnot depend on each other."
}
],
"id": "CVE-2023-54050",
"lastModified": "2026-08-04T10:19:26.553",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2025-12-24T13:16:06.670",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/66e9f2fb3e753f820bec2a98e8c6387029988320"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6f2eee5457bc48b0426dedfd78cdbdea241a6edb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/79079cebbeed624b9d01cfcf1e3254ae1a1f6e14"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a6da0ab9847779e05a7416c7a98148b549de69ef"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b5fda08ef213352ac2df7447611eb4d383cce929"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cc29c7216d7f057eb0613b97dc38c7e1962a88d2"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ef9aac603659e9ffe7d69ae16e3f0fc0991a965b"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Deferred"
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-10-16T18:21:12+00:00",
"cve": "CVE-2023-54050",
"id": "CVE-2023-54050",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:known_affected": "14",
"product_status:known_not_affected": "261",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ubifs: Fix memleak when insert_old_idx() failed",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54050.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.