CVE-2023-54050
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memleak when insert_old_idx() failed Following process will cause a memleak for copied up znode: dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) return ERR_PTR(err); // No one refers to zn. Fetch a reproducer in [Link]. Function copy_znode() is split into 2 parts: resource allocation and znode replacement, insert_old_idx() is split in similar way, so resource cleanup could be done in error handling path without corrupting metadata(mem & disk). It's okay that old index inserting is put behind of add_idx_dirt(), old index is used in layout_leb_in_gaps(), so the two processes do not depend on each other.
Affected versions
Linux kernel versions
2.6.27
and later are affected. Fixed in
4.19.283,
5.4.243,
5.10.180,
5.15.111,
6.1.28,
6.2.15,
6.3.2,
6.4
and their respective stable series.
References
The following references provide additional information about CVE-2023-54050 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/3ae75f82c33fa1b4ca2006b55c84f4ef4a428d4d
-
PatchKernel patch commithttps://git.kernel.org/stable/c/66e9f2fb3e753f820bec2a98e8c6387029988320
-
PatchKernel patch commithttps://git.kernel.org/stable/c/6f2eee5457bc48b0426dedfd78cdbdea241a6edb
Frequently asked questions
-
What is CVE-2023-54050?
CVE-2023-54050 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.27 onward and has been patched in 4.19.283, 5.4.243, 5.10.180 and others. CVE-2023-54050 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54050?
Yes — CVE-2023-54050 has been patched. Fixed versions include 4.19.283, 5.4.243, 5.10.180 and others. If you are running Linux kernel 2.6.27 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54050 actively exploited?
No — CVE-2023-54050 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.