CVE-2023-34256
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An issue was discovered in the Linux kernel before version 6.3.3 related to an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c. The problem arises from improper offset checking in the ext4_group_desc_csum function.
Risk Assessment
This vulnerability may lead to unauthorized memory reads, posing a risk of sensitive data exposure. There is controversy regarding the significance of this issue, as the kernel is not designed to defend against attacks when modifying the block device while it is mounted by the filesystem.
Recommendation
It is recommended to update the Linux kernel to version 6.3.3 or later to mitigate this vulnerability. Additionally, consider monitoring access to block devices to minimize risk.
Original NVD description (English source)
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.