Kernel Panic Vulnerability in Linux Package: Addressing Slab-Out-Of-Bounds Issue
Summary
CVE-2023-53420: In the Linux kernel, the following vulnerability has been resolved: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/... Affects linux versions < 6.1.52-1. Fixed in 6.1.52-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, such as the one identified in this report, which affects the NTFS file system handling within the kernel.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the NTFS file system implementation, specifically in the ntfs_listxattr() function. This issue can lead to a kernel panic due to a slab-out-of-bounds read, which occurs when the code attempts to access memory outside the allocated bounds. The vulnerability originates from improper handling of extended attribute names, where a zero-length name could cause the system to access invalid memory, potentially leading to crashes or unpredictable behavior.
How To Fix
Minimum fixed version
6.1.52-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2023-53420 vulnerability in the Linux kernel poses a significant risk due to potential kernel panics caused by improper memory access. Users are strongly advised to update their systems to the patched versions to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53420 is a vulnerability in the Linux kernel affecting the NTFS file system, which can lead to a kernel panic due to slab-out-of-bounds access.
This vulnerability can cause your system to crash or behave unpredictably, especially when handling NTFS file systems with extended attributes.
The vulnerability affects Linux versions prior to 6.1.52-1 for Debian 12, and prior to 6.4.4-1 for Debian 13 and 14.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
