CVE - CVE-2023-52979

CVE-ID
CVE-2023-52979	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: squashfs: harden sanity check in squashfs_read_xattr_id_table While mounting a corrupted filesystem, a signed integer '*xattr_ids' can become less than zero. This leads to the incorrect computation of 'len' and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() or out-of-bounds accesses in the next sanity checks inside squashfs_read_xattr_id_table(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/29e774dcb27116c06b9c57b1f1f14a1623738989 URL:https://git.kernel.org/stable/c/29e774dcb27116c06b9c57b1f1f14a1623738989 MISC:https://git.kernel.org/stable/c/72e544b1b28325fe78a4687b980871a7e4101f76 URL:https://git.kernel.org/stable/c/72e544b1b28325fe78a4687b980871a7e4101f76 MISC:https://git.kernel.org/stable/c/b30a74f83265c24d1d0842c6c3928cd2e775a3fb URL:https://git.kernel.org/stable/c/b30a74f83265c24d1d0842c6c3928cd2e775a3fb MISC:https://git.kernel.org/stable/c/b7398efe24a965cf3937b716c0b1011c201c5d6e URL:https://git.kernel.org/stable/c/b7398efe24a965cf3937b716c0b1011c201c5d6e MISC:https://git.kernel.org/stable/c/cf5d6612092408157db6bb500c70bf6d67c40fbc URL:https://git.kernel.org/stable/c/cf5d6612092408157db6bb500c70bf6d67c40fbc MISC:https://git.kernel.org/stable/c/db76fc535fbdfbf29fd0b93e49627537ad794c8c URL:https://git.kernel.org/stable/c/db76fc535fbdfbf29fd0b93e49627537ad794c8c MISC:https://git.kernel.org/stable/c/de2785aa3448d1ee7be3ab47fd4a873025f1b3d7 URL:https://git.kernel.org/stable/c/de2785aa3448d1ee7be3ab47fd4a873025f1b3d7
Assigning CNA
kernel.org
Date Record Created
20250327	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250327)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)