CVE-2023-34256
There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset.
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.25% probability · 16th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- linux/linux kernel · suse/linux enterprise · debian/debian linux
- Source
- cve@mitre.org
References
- https://bugzilla.suse.com/show_bug.cgi?id=1211895Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3Mailing List, Patch
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31Mailing List, Patch
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
- https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321Mailing List, Patch
- https://bugzilla.suse.com/show_bug.cgi?id=1211895Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3Mailing List, Patch
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31Mailing List, Patch
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
- https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321Mailing List, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.