{ "cveId": "CVE-2023-53692", "url": "https://patchblox.com/security/cve/CVE-2023-53692", "summary": "CVE-2023-53692 is fixed in 20 products on 1 platform, first by ALAS2023-2023-184, released May 25, 2023. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free read in ext4_find_exten...", "description": "In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free read in ext4_find_extent for bigalloc \u002B inline Syzbot found the following issue: loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] BUG: KASAN: use-after-free in ext4_find_extent\u002B0x76e/0xd90 fs/ext4/extents.c:931 Read of size 4 at addr ffff888073644750 by task syz-executor420/5067 CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: \u003CTASK\u003E __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl\u002B0x1b1/0x290 lib/dump_stack.c:106 print_address_description\u002B0x74/0x340 mm/kasan/report.c:306 print_report\u002B0x107/0x1f0 mm/kasan/report.c:417 kasan_report\u002B0xcd/0x100 mm/kasan/report.c:517 ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] ext4_find_extent\u002B0x76e/0xd90 fs/ext4/extents.c:931 ext4_clu_mapped\u002B0x117/0x970 fs/ext4/extents.c:5809 ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] ext4_da_get_block_prep\u002B0x9e8/0x13c0 fs/ext4/inode.c:1870 ext4_block_write_begin\u002B0x6a8/0x2290 fs/ext4/inode.c:1098 ext4_da_write_begin\u002B0x539/0x760 fs/ext4/inode.c:3082 generic_perform_write\u002B0x2e4/0x5e0 mm/filemap.c:3772 ext4_buffered_write_iter\u002B0x122/0x3a0 fs/ext4/file.c:285 ext4_file_write_iter\u002B0x1d0/0x18f0 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write\u002B0x7dc/0xc50 fs/read_write.c:584 ksys_write\u002B0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64\u002B0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd RIP: 0033:0x7f4b7a9737b9 RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 \u003C/TASK\u003E Above issue is happens when enable bigalloc and inline data feature. As commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for bigalloc \u002B inline. But it only resolved issue when has inline data, if inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However i_data is still store inline data in this scene. Then will trigger UAF when find extent. To resolve above issue, there is need to add judge \u0022ext4_has_inline_data(inode)\u0022 in ext4_clu_mapped().", "published": "2023-05-25T17:41:00Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.0016, "epssPercentile": 0.05187, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "bpftool-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-headers", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf-static", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.1.29-47.49", "release": "amzn 2023", "fixedVersion": "1.0-0.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.37-1", "fix": "DEBIAN-CVE-2023-53692", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53692", "released": "2025-10-22T14:15:43Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-53692", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53692", "released": "2025-10-22T14:15:43Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-53692", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53692", "released": "2025-10-22T14:15:43Z" }, { "platform": "linux", "product": "perf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "python3-perf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "python3-perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }