linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix OOB read in indx_insert_into_buffe...
CVE-2023-54063 is fixed in 20 products on 1 platform, first by ALAS2023-2023-184, released May 25, 2023. It is not reported as exploited. Patch Radar priority: High.
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix OOB read in indx_insert_into_buffer Syzbot reported a OOB read bug: BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630 Call Trace: <TASK> memmove+0x25/0x60 mm/kasan/shadow.c:54 indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 lookup_open fs/namei.c:3413 [inline] If the member struct INDEX_BUFFER *index of struct indx_node is incorrect, that is, the value of __le32 used is greater than the value of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when memmove is called in indx_insert_into_buffer(). Fix this by adding a check in hdr_find_e().
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bpftool · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| bpftool-debuginfo · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-debuginfo · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-debuginfo-common-aarch64 · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-debuginfo-common-x86_64 · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-devel · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-headers · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-libbpf · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-libbpf-devel · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-libbpf-static · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-livepatch-6.1.29-47.49 · amzn 2023 | 1.0-0.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-tools · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-tools-debuginfo · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| kernel-tools-devel · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| linux · Debian 12.15 (bookworm) | 6.1.37-1 | DEBIAN-CVE-2023-54063 | Dec 24, 2025 |
| linux · Debian 13.5 (trixie) | 6.3.7-1 | DEBIAN-CVE-2023-54063 | Dec 24, 2025 |
| linux · Debian 14 | 6.3.7-1 | DEBIAN-CVE-2023-54063 | Dec 24, 2025 |
| perf · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| perf-debuginfo · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| python3-perf · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
| python3-perf-debuginfo · amzn 2023 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 | May 25, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.