CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw allows a privileged local user to cause a system crash or other undefined behaviors.

This flaw has been rated as having Moderate impact because of the preconditions needed to trigger the issue. The vulnerability can be exploited by a regular user, but the filesystem should be mounted with debug_want_extra_isize=128 and the user must have write access to the filesystem. It's also important to emphasize that debug_want_extra_isize is a debug mount option and should never be used in production.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.