GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54132 (GCVE-0-2023-54132)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
erofs: stop parsing non-compact HEAD index if clusterofs is invalid
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: stop parsing non-compact HEAD index if clusterofs is invalid Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below: BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: <TASK> z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30 Note that normal images or images using compact indexes are not impacted. Let's fix this now. [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < 880c79bdb002b9d5b6940e52c2ad3829c2178207 (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < 7a4579cd6e4936de107c82499c3c9ee11b63401e (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < 060fecf1114ff9fcfe87953fe8c4fc5048777160 (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < 7ee7a86e28ce9ead7112286c388df8d254c373c6 (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < f01b2894928affa3339d355608713cf3db8360b8 (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < 96a845419b3722869f09883319de4d55c44d9aef (git)
Affected: 02827e1796b33f1794966f5c3101f8da2dfa9c1d , < cc4efd3dd2ac9f89143e5d881609747ecff04164 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.4.243 , ≤ 5.4.* (semver)
Unaffected: 5.10.180 , ≤ 5.10.* (semver)
Unaffected: 5.15.111 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "880c79bdb002b9d5b6940e52c2ad3829c2178207",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "7a4579cd6e4936de107c82499c3c9ee11b63401e",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "060fecf1114ff9fcfe87953fe8c4fc5048777160",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "7ee7a86e28ce9ead7112286c388df8d254c373c6",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "f01b2894928affa3339d355608713cf3db8360b8",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "96a845419b3722869f09883319de4d55c44d9aef",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            },
            {
              "lessThan": "cc4efd3dd2ac9f89143e5d881609747ecff04164",
              "status": "affected",
              "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.243",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.180",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.111",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: stop parsing non-compact HEAD index if clusterofs is invalid\n\nSyzbot generated a crafted image [1] with a non-compact HEAD index of\nclusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,\nwhich causes the following unexpected behavior as below:\n\n BUG: unable to handle page fault for address: fffff52101a3fff9\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 23ffed067 P4D 23ffed067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP KASAN\n CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023\n Workqueue: erofs_worker z_erofs_decompressqueue_work\n RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40\n ...\n Call Trace:\n  \u003cTASK\u003e\n  z_erofs_decompressqueue_work+0x99/0xe0\n  process_one_work+0x8f6/0x1170\n  worker_thread+0xa63/0x1210\n  kthread+0x270/0x300\n  ret_from_fork+0x1f/0x30\n\nNote that normal images or images using compact indexes are not\nimpacted.  Let\u0027s fix this now.\n\n[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by parsing a crafted EROFS on-disk compression index, which requires the malicious image to be mounted on the local system (block device, loop device, or fscache-backed layer); the kernel never processes this data directly from a network protocol.\nAC:L - The clusterofs field is fully attacker-controlled in the image and the corrupted mapping is deterministically consumed on the first read of the crafted file; there is no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker only needs to supply the crafted EROFS image (USB media, container/OCI layer, downloaded partition image) and requires no account or privilege on the target; the mount itself is performed by the victim\u0027s privileged user or automounter.\nUI:R - A user or an automount/container-runtime daemon must mount the attacker-supplied EROFS image, since erofs lacks FS_USERNS_MOUNT and cannot be mounted by the attacker directly; after mounting, any read of the crafted file triggers the bug with no further interaction.\nS:U - The out-of-bounds read and write occur in kernel memory within the same security authority as the kernel filesystem code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrapped page index causes z_erofs_fill_other_copies() to kmap an out-of-bounds pointer and memcpy wild kernel memory into a page that is returned to userspace, giving an arbitrary kernel-memory disclosure primitive.\nI:H - When the out-of-bounds slot reads as NULL, z_erofs_do_decompressed_bvec() writes a valid struct page pointer to an attacker-influenced index far past the decompressed_pages array \u2014 an OOB write onto the erofs worker\u0027s kernel stack or adjacent heap, which is exploitable for control-flow corruption.\nA:H - The syzbot reproducer shows an unhandled page fault and oops in z_erofs_decompress_queue running in the erofs_worker kthread, and the OOB write reliably corrupts kernel memory, causing a panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:32.148Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/880c79bdb002b9d5b6940e52c2ad3829c2178207"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a4579cd6e4936de107c82499c3c9ee11b63401e"
        },
        {
          "url": "https://git.kernel.org/stable/c/060fecf1114ff9fcfe87953fe8c4fc5048777160"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ee7a86e28ce9ead7112286c388df8d254c373c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01b2894928affa3339d355608713cf3db8360b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/96a845419b3722869f09883319de4d55c44d9aef"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc4efd3dd2ac9f89143e5d881609747ecff04164"
        }
      ],
      "title": "erofs: stop parsing non-compact HEAD index if clusterofs is invalid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54132",
    "datePublished": "2025-12-24T13:06:49.030Z",
    "dateReserved": "2025-12-24T13:02:52.522Z",
    "dateUpdated": "2026-08-05T09:17:32.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54132",
      "date": "2026-09-18",
      "epss": "0.00172",
      "percentile": "0.06972"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "880c79bdb002b9d5b6940e52c2ad3829c2178207",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a4579cd6e4936de107c82499c3c9ee11b63401e",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "060fecf1114ff9fcfe87953fe8c4fc5048777160",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ee7a86e28ce9ead7112286c388df8d254c373c6",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f01b2894928affa3339d355608713cf3db8360b8",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96a845419b3722869f09883319de4d55c44d9aef",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc4efd3dd2ac9f89143e5d881609747ecff04164",
                    "status": "affected",
                    "version": "02827e1796b33f1794966f5c3101f8da2dfa9c1d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/erofs/zmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.243",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.180",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: stop parsing non-compact HEAD index if clusterofs is invalid\n\nSyzbot generated a crafted image [1] with a non-compact HEAD index of\nclusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,\nwhich causes the following unexpected behavior as below:\n\n BUG: unable to handle page fault for address: fffff52101a3fff9\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 23ffed067 P4D 23ffed067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP KASAN\n CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023\n Workqueue: erofs_worker z_erofs_decompressqueue_work\n RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40\n ...\n Call Trace:\n  \u003cTASK\u003e\n  z_erofs_decompressqueue_work+0x99/0xe0\n  process_one_work+0x8f6/0x1170\n  worker_thread+0xa63/0x1210\n  kthread+0x270/0x300\n  ret_from_fork+0x1f/0x30\n\nNote that normal images or images using compact indexes are not\nimpacted.  Let\u0027s fix this now.\n\n[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com"
          }
        ],
        "id": "CVE-2023-54132",
        "lastModified": "2026-08-04T10:19:30.863",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:15.180",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/060fecf1114ff9fcfe87953fe8c4fc5048777160"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a4579cd6e4936de107c82499c3c9ee11b63401e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ee7a86e28ce9ead7112286c388df8d254c373c6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/880c79bdb002b9d5b6940e52c2ad3829c2178207"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96a845419b3722869f09883319de4d55c44d9aef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc4efd3dd2ac9f89143e5d881609747ecff04164"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f01b2894928affa3339d355608713cf3db8360b8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T12:53:36+00:00",
      "cve": "CVE-2023-54132",
      "id": "CVE-2023-54132",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (erofs): Denial of service via crafted erofs image",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54132.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.