CVE-2023-52436

f2fs: explicitly null-terminate the xattr list

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

f2fs: explicitly null-terminate the xattr list

When setting an xattr, explicitly null-terminate the xattr list. This
eliminates the fragile assumption that the unused xattr space is always
zeroed.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: termina explícitamente en nulo la lista xattr Al configurar un xattr, termina explícitamente en nulo la lista xattr. Esto elimina la frágil suposición de que el espacio xattr no utilizado siempre se pone a cero.

*Credits: N/A

CVSS Scores

NISTv3.1 7.8

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-02-20 CVE Reserved
2024-02-20 CVE Published
2024-04-21 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (10)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/16ae3132ff7746894894927c1892493693b89135	2024-01-25
https://git.kernel.org/stable/c/12cf91e23b126718a96b914f949f2cdfeadc7b2a	2024-01-25
https://git.kernel.org/stable/c/3e47740091b05ac8d7836a33afd8646b6863ca52	2024-01-25
https://git.kernel.org/stable/c/32a6cfc67675ee96fe107aeed5af9776fec63f11	2024-01-25
https://git.kernel.org/stable/c/5de9e9dd1828db9b8b962f7ca42548bd596deb8a	2024-01-20
https://git.kernel.org/stable/c/2525d1ba225b5c167162fa344013c408e8b4de36	2024-01-20
https://git.kernel.org/stable/c/f6c30bfe5a49bc38cae985083a11016800708fea	2024-01-20
https://git.kernel.org/stable/c/e26b6d39270f5eab0087453d9b544189a38c8564	2023-11-17

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.306 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.306"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.268 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.268"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.209 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.209"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.148 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.148"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.74 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.74"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.13 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.13"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.7.1 Search vendor "Linux" for product "Linux Kernel" and version " < 6.7.1"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.8 Search vendor "Linux" for product "Linux Kernel" and version " < 6.8"		en		Affected