CVE-2023-53035

nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()

State: Published
Severity: Not scored
Published: May 2, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()

The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO.

This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side.

KMSAN-enabled kernels detect this issue as follows:

BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0xc0/0x100 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:169 [inline] nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at: __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572 alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287 __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599 nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Bytes 16-127 of 3968 are uninitialized ...

This eliminates the leak issue by initializing the page allocated as buffer using get_zeroed_page().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	003ff182fddde09ddfb8d079bbdb02f9d2122082 to before a94932381e8dae4117e9129b3c1282e18aa97b05Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 9c5034e9a0e03db8d5e9eabb176340259b5b97e4Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before d18db946cc6a394291539e030df32324285648f7Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 5bb105cc72beb9d51bf12f5c657336d2d35bdc5dAffected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 5f33b042f74fc9662eba17f4cd19b07d84bbc6c5Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 8a6550b365c0ce2e65905de57dcbfe1f7d629726Affected 003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 003587000276f81d0114b5ce773d80c119d8cb30Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 4.14.312 through 4.14.Not affected 4.19.280 through 4.19.Not affected 5.4.240 through 5.4.Not affected 5.10.177 through 5.10.Not affected 5.15.105 through 5.15.Not affected 6.1.22 through 6.1.Not affected 6.2.9 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

003ff182fddde09ddfb8d079bbdb02f9d2122082 to before a94932381e8dae4117e9129b3c1282e18aa97b05Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 9c5034e9a0e03db8d5e9eabb176340259b5b97e4Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before d18db946cc6a394291539e030df32324285648f7Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 5bb105cc72beb9d51bf12f5c657336d2d35bdc5dAffected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 5f33b042f74fc9662eba17f4cd19b07d84bbc6c5Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 8a6550b365c0ce2e65905de57dcbfe1f7d629726Affected
003ff182fddde09ddfb8d079bbdb02f9d2122082 to before 003587000276f81d0114b5ce773d80c119d8cb30Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
4.14.312 through 4.14.*Not affected
4.19.280 through 4.19.*Not affected
5.4.240 through 5.4.*Not affected
5.10.177 through 5.10.*Not affected
5.15.105 through 5.15.*Not affected
6.1.22 through 6.1.*Not affected
6.2.9 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.