CVE-2023-53285

In the Linux kernel, the following vulnerability has been resolved:

ext4: add bounds checking in get_max_inline_xattr_value_size()

Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is writing to the block device while the file system is mounted, it's possible for the inode table to get corrupted. Add bounds checking to avoid reading beyond the end of allocated memory if this happens.

This flaw is rated as Moderate severity because exploitation requires local access and specialized privileges to alter the raw storage device while an ext4 partition is mounted. Under default Red Hat Enterprise Linux deployments, raw block devices are restricted from unprivileged user access, limiting exposure to environments where untrusted local users have direct storage write permissions. Successful exploitation could result in a kernel crash causing a denial of service or unintentional leakage of kernel memory, but does not allow direct privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.