CVE-2023-53683

A robustness flaw was found in the Linux kernel Hierarchical File System Plus file system in the way inode records are validated when reading or writing catalog entries. Crafted images can provide invalid lengths that trigger kernel warnings intended for internal errors. A local user could use this flaw to provoke warnings and disrupt file system operations, resulting in a denial of service.

hfsplus_cat_read_inode() and hfsplus_cat_write_inode() contained assertions that fired on malformed on-disk data, which is user-controlled when mounting untrusted media. The fix removes the panic-triggering warnings for these conditions and treats invalid lengths as input errors, preventing a kernel warning path from being used to disrupt the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module hfsplus from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.