FS_IOC_ENABLE_VERITY Vulnerability in Linux Package: Impact on File Descriptor Access Modes
Summary
DEBIAN-CVE-2023-53172: In the Linux kernel, the following vulnerability has been resolved: fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds Commit 56124d6c87fd ("fsverity: support enabling with tree block size < PAGE_SIZE") changed FS_IOC_E... Affects linux versions < 6.3.7-1. Fixed in 6.3.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the operating system, responsible for managing hardware and system resources. It provides essential functionalities such as process management, memory management, and device control. This vulnerability specifically affects the FS_IOC_ENABLE_VERITY ioctl operation, which is used to enable file integrity verification on files. The issue arises when this operation is called on file descriptors opened with access mode 3, which is intended for ioctl access only, leading to unintended consequences.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the FS_IOC_ENABLE_VERITY ioctl operation. This vulnerability was introduced by a commit that changed the way file data is read, making it possible for a warning condition to be triggered when the operation is called on a file descriptor that does not support reading. This could potentially lead to unexpected behavior or crashes when applications attempt to use this ioctl on inappropriate file descriptors. The documentation for FS_IOC_ENABLE_VERITY specifies that it requires O_RDONLY, indicating that it should not be used with ioctl-only file descriptors.
How To Fix
Minimum fixed version
6.3.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. It is advised to avoid using FS_IOC_ENABLE_VERITY on file descriptors that are opened with access mode 3 until the package is updated.
Conclusion
The FS_IOC_ENABLE_VERITY vulnerability in the Linux package poses a risk when the ioctl operation is used on file descriptors that are not intended for reading. Users are encouraged to update their systems to the patched version to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
FS_IOC_ENABLE_VERITY is an ioctl operation in the Linux kernel that enables file integrity verification for files.
Access mode 3 indicates that the file descriptor is opened for ioctl access only, meaning it does not support reading or writing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unexpected behavior or crashes in applications that attempt to use FS_IOC_ENABLE_VERITY on inappropriate file descriptors.
Yes, the patch is included in version 6.3.7-1 of the Linux package for both Debian 13 and Debian 14.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
