5.5

CVE-2023-53683

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

In the Linux kernel, the following vulnerability has been resolved:

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

syzbot is hitting WARN_ON() in hfsplus_cat_{read,write}_inode(), for
crafted filesystem image can contain bogus length. There conditions are
not kernel bugs that can justify kernel to panic.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.14.303 < 4.14.316
Linux ≫ Linux Kernel Version >= 4.19.270 < 4.19.284
Linux ≫ Linux Kernel Version >= 5.4.229 < 5.4.244
Linux ≫ Linux Kernel Version >= 5.10.163 < 5.10.181
Linux ≫ Linux Kernel Version >= 5.15.87 < 5.15.113
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.30
Linux ≫ Linux Kernel Version >= 6.2 < 6.3.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.034
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://git.kernel.org/stable/c/61af77acd039ffd221bf7adf0dc95d0a4d377505
Patch
https://git.kernel.org/stable/c/c074913b12db3632b11588b31bbfb0fa80a0a1c9
Patch
https://git.kernel.org/stable/c/a75d9211a07fed513c08c5d4861c4a36ac6a74fe
Patch
https://git.kernel.org/stable/c/c8daee66585897a4c90d937c91e762100237bff9
Patch
https://git.kernel.org/stable/c/37cab61a52d6f42b2d961c51bcf369f09e235fb5
Patch
https://git.kernel.org/stable/c/48960a503fcec76d3f72347b7e679dda08ca43be
Patch
https://git.kernel.org/stable/c/3a9d68d84b2e41ba3f2a727b36f035fad6800492
Patch
https://git.kernel.org/stable/c/81b21c0f0138ff5a499eafc3eb0578ad2a99622c
Patch