Bug 2227263 (CVE-2023-34256) - CVE-2023-34256 kernel: Out of bounds read in crc16 in lib/crc16.c
Summary: CVE-2023-34256 kernel: Out of bounds read in crc16 in lib/crc16.c
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2023-34256
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2227264
TreeView+ depends on / blocked
 
Reported: 2023-07-28 14:36 UTC by Pedro Sampaio
Modified: 2023-10-02 17:47 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-08 13:13:16 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-07-28 14:36:52 UTC 
** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1211895
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31
https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321
Comment 2 Rohit Keshri 2023-10-02 17:44:47 UTC 
This flaw is disputed.
Note You need to log in before you can comment on or make changes to this bug.