In the Linux kernel, the following vulnerability has been resolved:
udf: Do not bother merging very long extents
When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53506.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53506.json"
[
{
"id": "CVE-2023-53506-2a77c497",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d029799d381a9ee06209a222cae75f04c5d5304",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-453d0ce3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a965da79f2d22601f329cbfce588386b0847544",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-699aaed8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d20e3b768aff32112bdce8d3219d923ae75f9f1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-6e47c019",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9ac6d2e04ea0782b91a00ba10706002f3ec4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-9d129e01",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-9dec848e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-a375d665",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8d602f0723586e668bae7e65c832ceb9bcc8bc",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-ad7b871b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@965982feb333aefa9256c0fe188b5f1b958aef63",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-af596ff5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d029799d381a9ee06209a222cae75f04c5d5304",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-b30f9cd5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a965da79f2d22601f329cbfce588386b0847544",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-c81b398b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9ac6d2e04ea0782b91a00ba10706002f3ec4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-cc866f82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d52252a1de4cf96a34f722b0cd8902d8ff78eb57",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-d05bd71b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@965982feb333aefa9256c0fe188b5f1b958aef63",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-d586d0fe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d20e3b768aff32112bdce8d3219d923ae75f9f1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-d5f3eb89",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8d602f0723586e668bae7e65c832ceb9bcc8bc",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144255938865232536911917293175094421922",
"34378818515534594999618064410197502942",
"294316264884484775105336486716432034531",
"193563777441301129168986511498842259681",
"168465293601363670593105173866882490285",
"108500699429563016164119913930224734344",
"12298921723756272977723851633539812694",
"104322399193770077571662847632696820107",
"272227931530516174342261591475395200761",
"234949233481377338781905781120346364755",
"296431590711870766561865205896975699018",
"136134156101522526958478947129044398145",
"257088725335855920872990266607020396583",
"332686176151482782682102530666759584778",
"335023048584471051063614625411447928251",
"343308559329998533265924672724318036",
"260788863409292873290253254219542328691",
"118692396928564883973109841250840774471",
"209006822145755871421565395215015151733",
"323879334144075424026088376107671317722"
]
},
"target": {
"file": "fs/udf/inode.c"
}
},
{
"id": "CVE-2023-53506-dc66417f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d52252a1de4cf96a34f722b0cd8902d8ff78eb57",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "129789437230720907791430744440435091078",
"length": 2903.0
},
"target": {
"function": "udf_merge_extents",
"file": "fs/udf/inode.c"
}
}
]