GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54130 (GCVE-0-2023-54130)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
Summary
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling Commit 55d1cbbbb29e ("hfs/hfsplus: use WARN_ON for sanity check") fixed a build warning by turning a comment into a WARN_ON(), but it turns out that syzbot then complains because it can trigger said warning with a corrupted hfs image. The warning actually does warn about a bad situation, but we are much better off just handling it as the error it is. So rather than warn about us doing bad things, stop doing the bad things and return -EIO. While at it, also fix a memory leak that was introduced by an earlier fix for a similar syzbot warning situation, and add a check for one case that historically wasn't handled at all (ie neither comment nor subsequent WARN_ON).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c886c10a6eddb99923b315f42bf63f448883ef9a , < cc2164ada548addfa8ee215196661c3afe0c5154 (git)
Affected: 2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30 , < 82725be426bce0a425cc5e26fbad61ffd29cff03 (git)
Affected: 90103ccb6e60aa4efe48993d23d6a528472f2233 , < da23752d9660ba7a8ca6c5768fd8776f67f59ee7 (git)
Affected: 4fd3a11804c8877ff11fec59c5c53f1635331e3e , < be01f35efa876eb81cebab2cb0add068b7280ef4 (git)
Affected: 48d9e2e6de01ed35e965eb549758a837c07b601d , < f10defb0be6ac42fb6a97b45920d32da6bd6fde8 (git)
Affected: 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb , < 90e019006644dad35862cb4aa270f561b0732066 (git)
Affected: 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb , < 45917be9f0af339a45b4619f31c902d37b8aed59 (git)
Affected: 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb , < cb7a95af78d29442b8294683eca4897544b8ef46 (git)
Affected: 8c40f2dbae603ef0bd21e87c63f54ec59fd88256 (git)
Affected: 367296925c7625c3969d2a78d7a3e1dee161beb5 (git)
Affected: 4.9.337 , < 4.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.0.19 , ≤ 6.0.* (semver)
Unaffected: 6.1.5 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc2164ada548addfa8ee215196661c3afe0c5154",
              "status": "affected",
              "version": "c886c10a6eddb99923b315f42bf63f448883ef9a",
              "versionType": "git"
            },
            {
              "lessThan": "82725be426bce0a425cc5e26fbad61ffd29cff03",
              "status": "affected",
              "version": "2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30",
              "versionType": "git"
            },
            {
              "lessThan": "da23752d9660ba7a8ca6c5768fd8776f67f59ee7",
              "status": "affected",
              "version": "90103ccb6e60aa4efe48993d23d6a528472f2233",
              "versionType": "git"
            },
            {
              "lessThan": "be01f35efa876eb81cebab2cb0add068b7280ef4",
              "status": "affected",
              "version": "4fd3a11804c8877ff11fec59c5c53f1635331e3e",
              "versionType": "git"
            },
            {
              "lessThan": "f10defb0be6ac42fb6a97b45920d32da6bd6fde8",
              "status": "affected",
              "version": "48d9e2e6de01ed35e965eb549758a837c07b601d",
              "versionType": "git"
            },
            {
              "lessThan": "90e019006644dad35862cb4aa270f561b0732066",
              "status": "affected",
              "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
              "versionType": "git"
            },
            {
              "lessThan": "45917be9f0af339a45b4619f31c902d37b8aed59",
              "status": "affected",
              "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
              "versionType": "git"
            },
            {
              "lessThan": "cb7a95af78d29442b8294683eca4897544b8ef46",
              "status": "affected",
              "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8c40f2dbae603ef0bd21e87c63f54ec59fd88256",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "367296925c7625c3969d2a78d7a3e1dee161beb5",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.19",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling\n\nCommit 55d1cbbbb29e (\"hfs/hfsplus: use WARN_ON for sanity check\") fixed\na build warning by turning a comment into a WARN_ON(), but it turns out\nthat syzbot then complains because it can trigger said warning with a\ncorrupted hfs image.\n\nThe warning actually does warn about a bad situation, but we are much\nbetter off just handling it as the error it is.  So rather than warn\nabout us doing bad things, stop doing the bad things and return -EIO.\n\nWhile at it, also fix a memory leak that was introduced by an earlier\nfix for a similar syzbot warning situation, and add a check for one case\nthat historically wasn\u0027t handled at all (ie neither comment nor\nsubsequent WARN_ON)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only by mounting an attacker-crafted HFS filesystem image (removable media automount or loop-mounted file) and letting normal inode writeback run; there is no network-facing path to `hfs_write_inode`.\nAC:L - The attacker fully controls the B-tree node offset table that determines `fd.entryoffset`/`fd.entrylength`, so the short-record condition and the out-of-bounds offset are set deterministically in the image; no race or unpredictable state is involved.\nPR:L - A local unprivileged user triggers this by supplying an image that is mounted via the standard removable-media/automount path used to score the other hfs/hfsplus image-parsing CVEs; no elevated capability is needed by the attacker supplying the image.\nUI:N - Once the image is mounted, the vulnerable path executes automatically from generic writeback (dirty inode flush, sync, or umount) with no victim action required.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `hfs_bnode_read()` copies 70/102 bytes from an attacker-chosen offset past the record and node into a stack union, and that data is subsequently written back into the page cache and reachable through the filesystem, giving out-of-bounds kernel memory disclosure.\nI:H - The unguarded `hfs_bnode_write()` performs a `memcpy_to_page()` of up to 102 bytes at an attacker-controlled offset with no bounds check, yielding an out-of-bounds heap write with partly controlled content \u2014 a corruption primitive usable for control-flow hijacking.\nA:H - The same out-of-bounds write reliably corrupts adjacent page-cache/heap memory causing oops or panic, and the unbalanced `hfs_find_init()` error path returns to userspace holding `cat_tree-\u003etree_lock`, permanently deadlocking all further catalog operations on the mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:31.074Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc2164ada548addfa8ee215196661c3afe0c5154"
        },
        {
          "url": "https://git.kernel.org/stable/c/82725be426bce0a425cc5e26fbad61ffd29cff03"
        },
        {
          "url": "https://git.kernel.org/stable/c/da23752d9660ba7a8ca6c5768fd8776f67f59ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/be01f35efa876eb81cebab2cb0add068b7280ef4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f10defb0be6ac42fb6a97b45920d32da6bd6fde8"
        },
        {
          "url": "https://git.kernel.org/stable/c/90e019006644dad35862cb4aa270f561b0732066"
        },
        {
          "url": "https://git.kernel.org/stable/c/45917be9f0af339a45b4619f31c902d37b8aed59"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb7a95af78d29442b8294683eca4897544b8ef46"
        }
      ],
      "title": "hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54130",
    "datePublished": "2025-12-24T13:06:47.502Z",
    "dateReserved": "2025-12-24T13:02:52.521Z",
    "dateUpdated": "2026-08-05T09:17:31.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54130",
      "date": "2026-09-18",
      "epss": "0.00161",
      "percentile": "0.05722"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cc2164ada548addfa8ee215196661c3afe0c5154",
                    "status": "affected",
                    "version": "c886c10a6eddb99923b315f42bf63f448883ef9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "82725be426bce0a425cc5e26fbad61ffd29cff03",
                    "status": "affected",
                    "version": "2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da23752d9660ba7a8ca6c5768fd8776f67f59ee7",
                    "status": "affected",
                    "version": "90103ccb6e60aa4efe48993d23d6a528472f2233",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be01f35efa876eb81cebab2cb0add068b7280ef4",
                    "status": "affected",
                    "version": "4fd3a11804c8877ff11fec59c5c53f1635331e3e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f10defb0be6ac42fb6a97b45920d32da6bd6fde8",
                    "status": "affected",
                    "version": "48d9e2e6de01ed35e965eb549758a837c07b601d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90e019006644dad35862cb4aa270f561b0732066",
                    "status": "affected",
                    "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45917be9f0af339a45b4619f31c902d37b8aed59",
                    "status": "affected",
                    "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb7a95af78d29442b8294683eca4897544b8ef46",
                    "status": "affected",
                    "version": "55d1cbbbb29e6656c662ee8f73ba1fc4777532eb",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8c40f2dbae603ef0bd21e87c63f54ec59fd88256",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "367296925c7625c3969d2a78d7a3e1dee161beb5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.337",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling\n\nCommit 55d1cbbbb29e (\"hfs/hfsplus: use WARN_ON for sanity check\") fixed\na build warning by turning a comment into a WARN_ON(), but it turns out\nthat syzbot then complains because it can trigger said warning with a\ncorrupted hfs image.\n\nThe warning actually does warn about a bad situation, but we are much\nbetter off just handling it as the error it is.  So rather than warn\nabout us doing bad things, stop doing the bad things and return -EIO.\n\nWhile at it, also fix a memory leak that was introduced by an earlier\nfix for a similar syzbot warning situation, and add a check for one case\nthat historically wasn\u0027t handled at all (ie neither comment nor\nsubsequent WARN_ON)."
          }
        ],
        "id": "CVE-2023-54130",
        "lastModified": "2026-08-04T10:19:30.740",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:14.987",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45917be9f0af339a45b4619f31c902d37b8aed59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/82725be426bce0a425cc5e26fbad61ffd29cff03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90e019006644dad35862cb4aa270f561b0732066"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be01f35efa876eb81cebab2cb0add068b7280ef4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb7a95af78d29442b8294683eca4897544b8ef46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc2164ada548addfa8ee215196661c3afe0c5154"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da23752d9660ba7a8ca6c5768fd8776f67f59ee7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f10defb0be6ac42fb6a97b45920d32da6bd6fde8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T15:10:14+00:00",
      "cve": "CVE-2023-54130",
      "id": "CVE-2023-54130",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: HFS/HFS+ filesystem vulnerability leading to denial of service and information disclosure.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54130.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.