Skip to content
Fencer Vulns
medium 5.5

CVE-2023-52933 json

Squashfs: fix handling and sanity checking of xattr_ids count

published 2025-03-27 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2023-59757

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: fix handling and sanity checking of xattr_ids count

A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing.

In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225.

Flaw 1 (64-bit systems only):

The signed integer xattr_ids variable causes sign extension.

This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long".

On a 64-bit system this is 64-bits in size, and causes the negative number to be sign extended and widened to 64-bits and then become unsigned. This produces the very large number 18446744073709548016 or 2^64 - 3600. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0 (stored in len).

Flaw 2 (32-bit systems only):

On a 32-bit system the integer variable is not widened by the unsigned long type of the sizeof operator (32-bits), and the signedness of the variable has no effect due it always being treated as unsigned.

The above corrupted xattr_ids value of 4294967071, when multiplied overflows and produces the number 4294963696 or 2^32 - 3400. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.

The effect of the 0 length computation:

In conjunction with the corrupted xattr_ids field, the filesystem also has a corrupted xattr_table_start value, where it matches the end of filesystem value of 850.

This causes the following sanity check code to fail because the incorrectly computed len of 0 matches the incorrect size of the table reported by the superblock (0 bytes).

len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);

/* * The computed size of the index table (len bytes) should exactly * match the table start and end points */ start = table_start + sizeof(*id_table); end = msblk->bytes_used;

if (len != (end - start)) return ERR_PTR(-EINVAL);

Changing the xattr_ids variable to be "usigned int" fixes the flaw on a 64-bit system. This relies on the fact the computation is widened by the unsigned long type of the sizeof operator.

Casting the variable to u64 in the above macro fixes this flaw on a 32-bit system.

It also means 64-bit systems do not implicitly rely on the type of the sizeof operator to widen the computation.

[1] https://lore.kernel.org/lkml/000000000000cd44f005f1a0f17f@google.com/

Patch / fix

  • Linux Linux 4.5, 4.10, 4.14.306, 4.19.273, 5.4.232, 5.10.168, 5.15.93, 6.1.11, 6.2
  • linux Debian 14, Debian 13, Debian 12 6.1.11-1

debian advisories DEBIAN-CVE-2023-52933

  • linux Ubuntu 18.04 LTS 4.15.0-211.222
  • linux Ubuntu 20.04 LTS 5.4.0-149.166
  • linux Ubuntu 22.04 LTS 5.15.0-72.79
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1156.169
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1102.110
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1036.40
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1105.114
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1034.42

ubuntu advisories UBUNTU-CVE-2023-52933

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-570.24.1.el9_6
  • rv RHEL 9 5.14.0-570.24.1.el9_6
  • perf RHEL 9 5.14.0-570.24.1.el9_6
  • rtla RHEL 9 5.14.0-570.24.1.el9_6
  • libperf RHEL 9 5.14.0-570.24.1.el9_6
  • kernel-rt RHEL 9 5.14.0-570.24.1.el9_6
  • kernel-64k RHEL 9 5.14.0-570.24.1.el9_6
  • kernel-core RHEL 9 5.14.0-570.24.1.el9_6

red hat advisories RHSA-2025:11245RHSA-2025:11045RHSA-2025:10830RHSA-2025:10829RHSA-2025:10527RHSA-2025:9880

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.100.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.100.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1.150500.6.47.1
  • kernel-64kb SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 5.14.21-150400.24.161.1
  • kernel-syms SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 5.14.21-150400.24.161.1

suse advisories SUSE-SU-2025:1293-1SUSE-SU-2025:1241-1SUSE-SU-2025:1195-1SUSE-SU-2025:1183-1SUSE-SU-2025:1176-1

  • kernel AlmaLinux 9 5.14.0-570.24.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.24.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.24.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.24.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.24.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.24.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.24.1.el9_6
  • kernel-core AlmaLinux 9 5.14.0-570.24.1.el9_6

almalinux advisories ALSA-2025:9880

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-52933 updated cvss 7.1

kernel: Squashfs: fix handling and sanity checking of xattr_ids count

  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.77.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.77.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.77.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.77.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.77.1.el9_4
    fixed: vendor fix RHSA-2025:11245
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.24.1.el9_6, perf 5.14.0-570.24.1.el9_6, rtla 5.14.0-570.24.1.el9_6, python3-perf 5.14.0-570.24.1.el9_6, kernel-devel-matched 5.14.0-570.24.1.el9_6, kernel-64k-devel-matched 5.14.0-570.24.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:9880
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.138.1.el9_0, kernel-devel-matched 5.14.0-70.138.1.el9_0, kernel-debug-devel-matched 5.14.0-70.138.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.138.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.138.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.138.1.el9_0, +2 more
    fixed: vendor fix RHSA-2025:10830
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.125.1.el9_2, rtla 5.14.0-284.125.1.el9_2, kernel-devel-matched 5.14.0-284.125.1.el9_2, kernel-64k-devel-matched 5.14.0-284.125.1.el9_2, kernel-debug-devel-matched 5.14.0-284.125.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.125.1.el9_2, +5 more
    fixed: vendor fix RHSA-2025:11045
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.77.1.el9_4, perf 5.14.0-427.77.1.el9_4, rtla 5.14.0-427.77.1.el9_4, kernel-devel-matched 5.14.0-427.77.1.el9_4, kernel-64k-devel-matched 5.14.0-427.77.1.el9_4, kernel-debug-devel-matched 5.14.0-427.77.1.el9_4, +6 more
    fixed: vendor fix RHSA-2025:11245
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.24.1.el9_6, kernel-64k 5.14.0-570.24.1.el9_6, kernel-core 5.14.0-570.24.1.el9_6, kernel-tools 5.14.0-570.24.1.el9_6, kernel-modules 5.14.0-570.24.1.el9_6, kernel-64k-core 5.14.0-570.24.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:9880
show 13 more
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.138.1.el9_0, bpftool 5.14.0-70.138.1.el9_0, kernel-core 5.14.0-70.138.1.el9_0, kernel-tools 5.14.0-70.138.1.el9_0, python3-perf 5.14.0-70.138.1.el9_0, kernel-modules 5.14.0-70.138.1.el9_0, +14 more
    fixed: vendor fix RHSA-2025:10830
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.125.1.el9_2, kernel 5.14.0-284.125.1.el9_2, kernel-64k 5.14.0-284.125.1.el9_2, kernel-core 5.14.0-284.125.1.el9_2, kernel-tools 5.14.0-284.125.1.el9_2, python3-perf 5.14.0-284.125.1.el9_2, +28 more
    fixed: vendor fix RHSA-2025:11045
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.77.1.el9_4, kernel 5.14.0-427.77.1.el9_4, kernel-64k 5.14.0-427.77.1.el9_4, kernel-core 5.14.0-427.77.1.el9_4, kernel-tools 5.14.0-427.77.1.el9_4, python3-perf 5.14.0-427.77.1.el9_4, +28 more
    fixed: vendor fix RHSA-2025:11245
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.24.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.24.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.24.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.24.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.24.1.el9_6
    fixed: vendor fix RHSA-2025:9880
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-kvm 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-core 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-modules 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-kvm 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-core 5.14.0-70.138.1.rt21.210.el9_0, +4 more
    fixed: vendor fix RHSA-2025:10829
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.24.1.el9_6, kernel-rt-64k 5.14.0-570.24.1.el9_6, kernel-rt-core 5.14.0-570.24.1.el9_6, kernel-rt-modules 5.14.0-570.24.1.el9_6, kernel-rt-64k-core 5.14.0-570.24.1.el9_6, kernel-rt-debug-core 5.14.0-570.24.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:9880
  • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-core 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-modules 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-core 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-modules 5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-modules-extra 5.14.0-70.138.1.rt21.210.el9_0, +2 more
    fixed: vendor fix RHSA-2025:10829
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-core 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-modules 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-debug-core 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-modules-core 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-debug-modules 5.14.0-284.125.1.rt14.410.el9_2, +4 more
    fixed: vendor fix RHSA-2025:10527
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.77.1.el9_4, kernel-rt-core 5.14.0-427.77.1.el9_4, kernel-rt-modules 5.14.0-427.77.1.el9_4, kernel-rt-debug-core 5.14.0-427.77.1.el9_4, kernel-rt-modules-core 5.14.0-427.77.1.el9_4, kernel-rt-debug-modules 5.14.0-427.77.1.el9_4, +4 more
    fixed: vendor fix RHSA-2025:11245
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.24.1.el9_6, kernel-rt-kvm 5.14.0-570.24.1.el9_6, kernel-rt-core 5.14.0-570.24.1.el9_6, kernel-rt-modules 5.14.0-570.24.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.24.1.el9_6, kernel-rt-debug-core 5.14.0-570.24.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:9880
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-kvm 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-core 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-modules 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-debug-kvm 5.14.0-284.125.1.rt14.410.el9_2, kernel-rt-debug-core 5.14.0-284.125.1.rt14.410.el9_2, +6 more
    fixed: vendor fix RHSA-2025:10527
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.77.1.el9_4, kernel-rt-kvm 5.14.0-427.77.1.el9_4, kernel-rt-core 5.14.0-427.77.1.el9_4, kernel-rt-modules 5.14.0-427.77.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.77.1.el9_4, kernel-rt-debug-core 5.14.0-427.77.1.el9_4, +6 more
    fixed: vendor fix RHSA-2025:11245
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.