« Volver al listado

CVE-2023-54153

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ext4: turn quotas off if mount failed after enabling quotas

Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:

To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.

Detalles técnicos trazas, registros y código del informe original
================================================================
unreferenced object 0xffff8cf68678e7c0 (size 64):
comm "mount", pid 746, jiffies 4294871231 (age 11.540s)
hex dump (first 32 bytes):
00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00  ............A...
c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00  ............H...
backtrace:
[<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880
[<00000000d4e621d7>] kmalloc_trace+0x39/0x140
[<00000000837eee74>] v2_read_file_info+0x18a/0x3a0
[<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770
[<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0
[<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4]
[<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4]
[<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4]
[<000000004a9489c4>] get_tree_bdev+0x1dc/0x370
[<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4]
[<00000000c7cb663d>] vfs_get_tree+0x31/0x160
[<00000000320e1bed>] do_new_mount+0x1d5/0x480
[<00000000c074654c>] path_mount+0x22e/0xbe0
[<0000000003e97a8e>] do_mount+0x95/0xc0
[<000000002f3d3736>] __x64_sys_mount+0xc4/0x160
[<0000000027d2140c>] do_syscall_64+0x3f/0x90
================================================================

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L+UI:R indica explotación en cliente (montaje de filesystem preparado). La vulnerabilidad causa fuga de memoria (kmemleak) durante montaje fallido, permitiendo DoS o corrupción de datos en caché.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory PermissionsRemote Data StorageFilter Network TrafficEncrypt Sensitive InformationApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-54153",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "11215630aada28307ba555a43138db6ac54fa825",
              "lessThan": "c327b83c59ee938792a0300df646efac39c7d6a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "11215630aada28307ba555a43138db6ac54fa825",
              "lessThan": "deef86fa3005cbb61ae8aa5729324c09b3f4ba73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "11215630aada28307ba555a43138db6ac54fa825",
              "lessThan": "77c3ca1108eb4a26db4f256c42b271a430cebc7d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "11215630aada28307ba555a43138db6ac54fa825",
              "lessThan": "d13f99632748462c32fc95d729f5e754bab06064",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60e2824ab30a19c7aaf5a3932bc155d18b2cd816",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a6d49257cbe53c7bca1a0353a6443f53cbed9cc7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2e7312ddaf629eecf4702b662da477a3bc39c31a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d558851e5ff443b020245b7a1a455c55accf740b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.14.196",
              "lessThan": "4.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.19.143",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.62",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.8.6",
              "lessThan": "5.9",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/ext4/super.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.*"
            },
            {
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ext4/super.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:17.307",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/77c3ca1108eb4a26db4f256c42b271a430cebc7d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c327b83c59ee938792a0300df646efac39c7d6a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d13f99632748462c32fc95d729f5e754bab06064",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/deef86fa3005cbb61ae8aa5729324c09b3f4ba73",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: turn quotas off if mount failed after enabling quotas\n\nYi found during a review of the patch \"ext4: don't BUG on inconsistent\njournal feature\" that when ext4_mark_recovery_complete() returns an error\nvalue, the error handling path does not turn off the enabled quotas,\nwhich triggers the following kmemleak:\n\n================================================================\nunreferenced object 0xffff8cf68678e7c0 (size 64):\ncomm \"mount\", pid 746, jiffies 4294871231 (age 11.540s)\nhex dump (first 32 bytes):\n00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00  ............A...\nc7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00  ............H...\nbacktrace:\n[<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880\n[<00000000d4e621d7>] kmalloc_trace+0x39/0x140\n[<00000000837eee74>] v2_read_file_info+0x18a/0x3a0\n[<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770\n[<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0\n[<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4]\n[<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4]\n[<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4]\n[<000000004a9489c4>] get_tree_bdev+0x1dc/0x370\n[<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4]\n[<00000000c7cb663d>] vfs_get_tree+0x31/0x160\n[<00000000320e1bed>] do_new_mount+0x1d5/0x480\n[<00000000c074654c>] path_mount+0x22e/0xbe0\n[<0000000003e97a8e>] do_mount+0x95/0xc0\n[<000000002f3d3736>] __x64_sys_mount+0xc4/0x160\n[<0000000027d2140c>] do_syscall_64+0x3f/0x90\n================================================================\n\nTo solve this problem, we add a \"failed_mount10\" tag, and call\next4_quota_off_umount() in this tag to release the enabled qoutas."
    }
  ],
  "lastModified": "2026-08-04T11:16:34.317",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}