CVE-2023-53450

In the Linux kernel, the following vulnerability has been resolved:

ext4: remove a BUG_ON in ext4_mb_release_group_pa()

If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, the calculation of the block group can underflow, and trigger a BUG_ON check. Change this to be an ext4_warning so that we don't crash the kernel.

The patch replaces a BUG_ON() in ext4_mb_release_group_pa() with a warning to prevent a kernel panic when the ext4 superblock is corrupted (e.g., s_first_data_block set to an invalid value). Impact is limited to availability: a malicious image or in-memory corruption can crash the kernel via a reachable assertion. For the CVSS the PR:L because exploitation requires mounting or modifying an ext4 volume, operations usually restricted to privileged users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.