« Volver al listado

CVE-2023-53804

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()

During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer().

Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de use-after-free en kernel Linux (AV:L, PR:L, sin UI) explotable para escalada de privilegios. El impacto es negación de servicio por crash del kernel durante unmount.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-53804",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "f31e18131ee2ce80a4da5c808221d25b1ae9ad6d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "2a782ea8ebd712a458466e3103e2881b4f886cb5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "116d53f09ff52e6f98e3fe1f85d8898d6ba26c68",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "6b4205ea97901f822004e6c8d59484ccfda03faa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "b8427b8522d9ede53015ba45a9978ba68d1162f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "acc2a40e428f12780004e1e9fce4722d88f909fd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "fb8e8d58f116d069e5939e1f786ac84e7fa4533e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e912a5b66837ee89fb025e67b5efeaa11930c2ce",
              "lessThan": "9b5a04ac3ad9898c4745cba46ea26de74ba56a8e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nilfs2/inode.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.37",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.316",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.284",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.*"
            },
            {
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nilfs2/inode.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-09T01:16:52.270",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/116d53f09ff52e6f98e3fe1f85d8898d6ba26c68",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2a782ea8ebd712a458466e3103e2881b4f886cb5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6b4205ea97901f822004e6c8d59484ccfda03faa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9b5a04ac3ad9898c4745cba46ea26de74ba56a8e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/acc2a40e428f12780004e1e9fce4722d88f909fd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8427b8522d9ede53015ba45a9978ba68d1162f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f31e18131ee2ce80a4da5c808221d25b1ae9ad6d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fb8e8d58f116d069e5939e1f786ac84e7fa4533e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()\n\nDuring unmount process of nilfs2, nothing holds nilfs_root structure after\nnilfs2 detaches its writer in nilfs_detach_log_writer().  However, since\nnilfs_evict_inode() uses nilfs_root for some cleanup operations, it may\ncause use-after-free read if inodes are left in \"garbage_list\" and\nreleased by nilfs_dispose_list() at the end of nilfs_detach_log_writer().\n\nFix this issue by modifying nilfs_evict_inode() to only clear inode\nwithout additional metadata changes that use nilfs_root if the file system\nis degraded to read-only or the writer is detached."
    }
  ],
  "lastModified": "2026-08-04T10:19:22.083",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}