CVE-2023-53506

A flaw was discovered in the UDF (Universal Disk Format) filesystem implementation in the Linux Kernel. The merging logic for very long extents attempted to push as much length as possible into the first extent, which introduced a bug. That bug may cause corruption of file extents on the filesystem when certain long-extent merges occur. A local user (with at least low privileges) on a system using the UDF filesystem could trigger this condition by manipulating extent lengths, potentially leading to file corruption (affecting confidentiality, integrity and availability).

This issue is triggered by a specially crafted disk image containing on-disk metadata inconsistencies. Exploitation requires that an attacker convince a user to download and use a malicious image from an untrusted source, a scenario with limited practical impact. Red Hat rates this as Low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.