CVE-2023-54313
Estado: AplazadaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_get_acl_rcu()
Fetch a reproducer in [Link].
Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.
Detalles técnicos trazas, registros y código del informe original
Following process:
P1 P2
path_openat
link_path_walk
may_lookup
inode_permission(rcu)
ovl_permission
acl_permission_check
check_acl
get_cached_acl_rcu
ovl_get_inode_acl
realinode = ovl_inode_real(ovl_inode)
drop_cache
__dentry_kill(ovl_dentry)
iput(ovl_inode)
ovl_destroy_inode(ovl_inode)
dput(oi->__upperdentry)
dentry_kill(upperdentry)
dentry_unlink_inode
upperdentry->d_inode = NULL
ovl_inode_upper
upperdentry = ovl_i_dentry_upper(ovl_inode)
d_inode(upperdentry) // returns NULL
IS_POSIXACL(realinode) // NULL pointer dereference
, will trigger an null pointer dereference at realinode:
[ 205.472797] BUG: kernel NULL pointer dereference, address:
0000000000000028
[ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted
6.3.0-12064-g2edfa098e750-dirty #1216
[ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300
[ 205.489584] Call Trace:
[ 205.489812] <TASK>
[ 205.490014] ovl_get_inode_acl+0x26/0x30
[ 205.490466] get_cached_acl_rcu+0x61/0xa0
[ 205.490908] generic_permission+0x1bf/0x4e0
[ 205.491447] ovl_permission+0x79/0x1b0
[ 205.491917] inode_permission+0x15e/0x2c0
[ 205.492425] link_path_walk+0x115/0x550
[ 205.493311] path_lookupat.isra.0+0xb2/0x200
[ 205.493803] filename_lookup+0xda/0x240
[ 205.495747] vfs_fstatat+0x7b/0xb0CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-54313",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "332f606b32b6291a944c8cf23b91f53a6e676525",
"lessThan": "d97481c7b2739a704848bb3c01f224dc71bdf78e",
"versionType": "git"
},
{
"status": "affected",
"version": "332f606b32b6291a944c8cf23b91f53a6e676525",
"lessThan": "c4a5fb1ae5d3f02d3227afde2b9339994389463d",
"versionType": "git"
},
{
"status": "affected",
"version": "332f606b32b6291a944c8cf23b91f53a6e676525",
"lessThan": "d536af163c53ce9f9bcfe87d2e9946f06f1a7ea4",
"versionType": "git"
},
{
"status": "affected",
"version": "332f606b32b6291a944c8cf23b91f53a6e676525",
"lessThan": "f4e19e595cc2e76a8a58413eb19d3d9c51328b53",
"versionType": "git"
}
],
"programFiles": [
"fs/overlayfs/inode.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/overlayfs/inode.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-12-30T13:16:20.540",
"references": [
{
"url": "https://git.kernel.org/stable/c/c4a5fb1ae5d3f02d3227afde2b9339994389463d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d536af163c53ce9f9bcfe87d2e9946f06f1a7ea4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d97481c7b2739a704848bb3c01f224dc71bdf78e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f4e19e595cc2e76a8a58413eb19d3d9c51328b53",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Deferred",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix null pointer dereference in ovl_get_acl_rcu()\n\nFollowing process:\n P1 P2\n path_openat\n link_path_walk\n may_lookup\n inode_permission(rcu)\n ovl_permission\n acl_permission_check\n check_acl\n get_cached_acl_rcu\n\t ovl_get_inode_acl\n\t realinode = ovl_inode_real(ovl_inode)\n\t drop_cache\n\t\t __dentry_kill(ovl_dentry)\n\t\t\t\tiput(ovl_inode)\n\t\t ovl_destroy_inode(ovl_inode)\n\t\t dput(oi->__upperdentry)\n\t\t dentry_kill(upperdentry)\n\t\t dentry_unlink_inode\n\t\t\t\t upperdentry->d_inode = NULL\n\t ovl_inode_upper\n\t upperdentry = ovl_i_dentry_upper(ovl_inode)\n\t d_inode(upperdentry) // returns NULL\n\t IS_POSIXACL(realinode) // NULL pointer dereference\n, will trigger an null pointer dereference at realinode:\n [ 205.472797] BUG: kernel NULL pointer dereference, address:\n 0000000000000028\n [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted\n 6.3.0-12064-g2edfa098e750-dirty #1216\n [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300\n [ 205.489584] Call Trace:\n [ 205.489812] <TASK>\n [ 205.490014] ovl_get_inode_acl+0x26/0x30\n [ 205.490466] get_cached_acl_rcu+0x61/0xa0\n [ 205.490908] generic_permission+0x1bf/0x4e0\n [ 205.491447] ovl_permission+0x79/0x1b0\n [ 205.491917] inode_permission+0x15e/0x2c0\n [ 205.492425] link_path_walk+0x115/0x550\n [ 205.493311] path_lookupat.isra.0+0xb2/0x200\n [ 205.493803] filename_lookup+0xda/0x240\n [ 205.495747] vfs_fstatat+0x7b/0xb0\n\nFetch a reproducer in [Link].\n\nUse the helper ovl_i_path_realinode() to get realinode and then do\nnon-nullptr checking."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\novl: corrige la desreferencia de puntero nulo en ovl_get_acl_rcu()\n\nEl siguiente proceso:\n P1 P2\n path_openat\n link_path_walk\n may_lookup\n inode_permission(rcu)\n ovl_permission\n acl_permission_check\n check_acl\n get_cached_acl_rcu\n\t ovl_get_inode_acl\n\t realinode = ovl_inode_real(ovl_inode)\n\t drop_cache\n\t\t __dentry_kill(ovl_dentry)\n\t\t\t\tiput(ovl_inode)\n\t\t ovl_destroy_inode(ovl_inode)\n\t\t dput(oi->__upperdentry)\n\t\t dentry_kill(upperdentry)\n\t\t dentry_unlink_inode\n\t\t\t\t upperdentry->d_inode = NULL\n\t ovl_inode_upper\n\t upperdentry = ovl_i_dentry_upper(ovl_inode)\n\t d_inode(upperdentry) // devuelve NULL\n\t IS_POSIXACL(realinode) // desreferencia de puntero nulo\n, activará una desreferencia de puntero nulo en realinode:\n [ 205.472797] BUG: desreferencia de puntero nulo del kernel, dirección:\n 0000000000000028\n [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted\n 6.3.0-12064-g2edfa098e750-dirty #1216\n [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300\n [ 205.489584] Traza de llamada:\n [ 205.489812] \n [ 205.490014] ovl_get_inode_acl+0x26/0x30\n [ 205.490466] get_cached_acl_rcu+0x61/0xa0\n [ 205.490908] generic_permission+0x1bf/0x4e0\n [ 205.491447] ovl_permission+0x79/0x1b0\n [ 205.491917] inode_permission+0x15e/0x2c0\n [ 205.492425] link_path_walk+0x115/0x550\n [ 205.493311] path_lookupat.isra.0+0xb2/0x200\n [ 205.493803] filename_lookup+0xda/0x240\n [ 205.495747] vfs_fstatat+0x7b/0xb0\n\nObtenga un reproductor en [Link].\n\nUse la función auxiliar ovl_i_path_realinode() para obtener realinode y luego realice una comprobación de puntero no nulo."
}
],
"lastModified": "2026-06-17T06:47:12.497",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}