CVE-2023-52436: f2fs: explicitly null-terminate the xattr list
In the Linux kernel, the following vulnerability has been resolved:
f2fs: explicitly null-terminate the xattr list
When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
Apply the f2fs fix to explicitly null-terminate the xattr list when setting an xattr, removing the assumption that unused xattr space is always zeroed.
Linux kernel (f2fs) xattr list termination = Explicitly null-terminate the xattr list when setting an xattr
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52436?
CVE-2023-52436 has been assigned a moderate severity level due to its impact on the stability and functionality of the Linux kernel.
How do I fix CVE-2023-52436?
To remediate CVE-2023-52436, update your Linux kernel to one of the fixed versions, such as 5.10.223-1, 6.1.123-1, or later.
Which Linux kernel versions are affected by CVE-2023-52436?
CVE-2023-52436 affects Linux kernel versions between 4.20.0 and 6.1.74, including specific versions within that range.
What components are impacted by CVE-2023-52436?
CVE-2023-52436 specifically impacts the f2fs file system in the Linux kernel regarding the handling of extended attributes.
Is CVE-2023-52436 being actively exploited?
As of the latest reports, there is no evidence suggesting that CVE-2023-52436 is actively being exploited in the wild.