CVE-2023-54062

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix invalid free tracking in ext4_xattr_move_to_block()

In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum.

However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored.

Leer descripción completaMostrar menos

So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1499.004 Application or System Exploitationimpact60 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact45 %

Vulnerabilidad local de kernel (AV:L, PR:L) que permite escalada de privilegios por error en gestión de memoria en ext4_xattr_move_to_block(). Puede causar DoS (crash) o corrupción de datos de atributos extendidos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Restrict File and Directory Permissions Remote Data Storage Filter Network Traffic Execution Prevention Encrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-54062",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c7851208abffe5ae4deb01cf48763911dc14fc67",
              "lessThan": "76887be2a96193cd11be818551b8934ecdb3123f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5cdc6a7339f250d44d4d469ed7a474ac0d6c7a7",
              "lessThan": "f30f3391d089dc91aef91d08f4b04a6c0df2b067",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3b28c799a1334adb5a19f42f03abe0d8cbb05938",
              "lessThan": "ba04d6af5ac440a6d5a2d35dc1d8e2cb0323550a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d738789ae9ec47d3458a008788f3cdc862ebf0cb",
              "lessThan": "1a8822343e67432b658145d2760a524c884da9d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a6744e14ce7045ab1a728bde9595f62fbd39f1d2",
              "lessThan": "8beaa3cb293a8f7bacf711cf52201d59859dbc40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b6d06b3be7648b3b0f428558293ddf6e2cb94bf",
              "lessThan": "c5fa4eedddd1c8342ce533cb401c0e693e55b4e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2efaf8c870c7067b8d1779773134f3481cd8f68",
              "lessThan": "a18670395e5f28acddeca037c5e4bd2ea961b70a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e9d62d252812575ded7c620d8fc67c32ff06c16",
              "lessThan": "b2fab1807d26acd1c6115b95b5eddd697d84751b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e9d62d252812575ded7c620d8fc67c32ff06c16",
              "lessThan": "b87c7cdf2bed4928b899e1ce91ef0d147017ba45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.14.308",
              "lessThan": "4.14.315",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.19.276",
              "lessThan": "4.19.283",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.235",
              "lessThan": "5.4.243",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.10.173",
              "lessThan": "5.10.180",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.99",
              "lessThan": "5.15.112",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.1.16",
              "lessThan": "6.1.29",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2.3",
              "lessThan": "6.2.16",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/ext4/xattr.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.315",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.283",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.243",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.180",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.112",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.29",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.*"
            },
            {
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.*"
            },
            {
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ext4/xattr.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:07.993",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a8822343e67432b658145d2760a524c884da9d4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/76887be2a96193cd11be818551b8934ecdb3123f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8beaa3cb293a8f7bacf711cf52201d59859dbc40",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a18670395e5f28acddeca037c5e4bd2ea961b70a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b2fab1807d26acd1c6115b95b5eddd697d84751b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b87c7cdf2bed4928b899e1ce91ef0d147017ba45",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ba04d6af5ac440a6d5a2d35dc1d8e2cb0323550a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c5fa4eedddd1c8342ce533cb401c0e693e55b4e3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f30f3391d089dc91aef91d08f4b04a6c0df2b067",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix invalid free tracking in ext4_xattr_move_to_block()\n\nIn ext4_xattr_move_to_block(), the value of the extended attribute\nwhich we need to move to an external block may be allocated by\nkvmalloc() if the value is stored in an external inode.  So at the end\nof the function the code tried to check if this was the case by\ntesting entry->e_value_inum.\n\nHowever, at this point, the pointer to the xattr entry is no longer\nvalid, because it was removed from the original location where it had\nbeen stored.  So we could end up calling kvfree() on a pointer which\nwas not allocated by kvmalloc(); or we could also potentially leak\nmemory by not freeing the buffer when it should be freed.  Fix this by\nstoring whether it should be freed in a separate variable."
    }
  ],
  "lastModified": "2026-08-04T10:19:26.813",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}