CVE-2023-54132 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
erofs: stop parsing non-compact HEAD index if clusterofs is invalid
Syzbot generated a crafted image [1] with a non-compact HEAD index of
clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below:
BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: <TASK> z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30
Note that normal images or images using compact indexes are not impacted. Let's fix this now.
[1] https://lore.kernel.org/r/[email protected]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability CVE-2023-54132 affects the Linux kernel's erofs (Extended Read-Only File System) implementation, specifically targeting the handling of non-compact HEAD index structures during decompression operations. This issue arises when processing crafted file system images that contain invalid clusterofs values in their non-compact index headers. The root cause lies in the kernel's failure to properly validate the clusterofs parameter before proceeding with decompression logic, creating a path where invalid memory access can occur. The vulnerability demonstrates a classic input validation flaw that allows maliciously crafted file system metadata to trigger kernel memory corruption.
The technical exploitation occurs when the kernel encounters a non-compact HEAD index with a clusterofs value of 33024, which significantly exceeds the valid range of 0 to lclustersize-1. This invalid parameter causes the z_erofs_decompress_queue function to attempt accessing memory at an address that does not correspond to valid page mappings, resulting in a page fault exception. The kernel's memory management subsystem detects this invalid access pattern and generates a kernel oops message with specific error codes indicating a supervisor read access to a non-present page. The call trace shows the execution flow leading to the failure point within the erofs worker thread context, where the decompression work queue processes the malformed index structure.
This vulnerability represents a significant security risk as it can lead to kernel memory corruption and potentially system instability or privilege escalation. The flaw specifically impacts the kernel's ability to safely handle malformed file system images, particularly those created through fuzzing tools like syzbot that generate crafted inputs to identify kernel vulnerabilities. The issue is categorized under CWE-129 as an Improper Validation of Array Index, where the kernel fails to validate the clusterofs parameter against expected bounds before using it in memory calculations. The exploitation scenario aligns with ATT&CK technique T1068 by leveraging kernel vulnerabilities to execute arbitrary code with elevated privileges.
The operational impact of this vulnerability extends beyond simple system crashes, as it could enable attackers to cause denial of service conditions or potentially gain unauthorized access to systems running affected kernel versions. The vulnerability affects only non-compact HEAD indexes and normal images or those using compact indexes remain unaffected, indicating the issue is specific to certain file system metadata structures. The fix implemented addresses the core validation problem by ensuring that clusterofs values are properly validated against the legitimate range before any decompression operations proceed, preventing the kernel from attempting invalid memory operations. This remediation approach follows established security practices for preventing buffer overflows and memory corruption vulnerabilities in kernel space code.