CVE-2023-2124: High severity Linux Linux kernel vulnerability
A flaw in the Linux Kernel found for the XFS file system. When mounting a user-supplied XFS disk image, the out of bounds memory access can happen. It happens for some corner case when data in Log journal of XFS image different from on-disk buffer that appears to be newer (so this is a dirty log case).
Reference: https://lore.kernel.org/linux-xfs/20230412214034.GL3223426@dread.disaster.area/T/#m1ebbcd1ad061d2d33bef6f0534a2b014744d152d
Other sources
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.
— Launchpad
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds access flaw in the XFS subsystem due to a missing metadata validation when mounting a user-supplied XFS disk image. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2124?
The severity of CVE-2023-2124 is considered high due to potential out-of-bounds memory access affecting the Linux Kernel.
How do I fix CVE-2023-2124?
To fix CVE-2023-2124, update the Linux Kernel to version 6.4 or newer.
Which systems are affected by CVE-2023-2124?
CVE-2023-2124 affects various Linux distributions using vulnerable versions of the Linux Kernel, specifically versions prior to 6.4.
Is CVE-2023-2124 remotely exploitable?
CVE-2023-2124 is potentially exploitable remotely, especially when mounting user-supplied XFS disk images.
What components are specifically impacted by CVE-2023-2124?
CVE-2023-2124 specifically impacts the XFS file system within the Linux Kernel.