{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53035","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-03-27T16:40:15.763Z","datePublished":"2025-05-02T15:54:54.876Z","dateUpdated":"2026-05-11T19:37:18.401Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:37:18.401Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()\n\nThe ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a\nmetadata array to/from user space, may copy uninitialized buffer regions\nto user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO\nand NILFS_IOCTL_GET_CPINFO.\n\nThis can occur when the element size of the user space metadata given by\nthe v_size member of the argument nilfs_argv structure is larger than the\nsize of the metadata element (nilfs_suinfo structure or nilfs_cpinfo\nstructure) on the file system side.\n\nKMSAN-enabled kernels detect this issue as follows:\n\n BUG: KMSAN: kernel-infoleak in instrument_copy_to_user\n include/linux/instrumented.h:121 [inline]\n BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n  _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  copy_to_user include/linux/uaccess.h:169 [inline]\n  nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Uninit was created at:\n  __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572\n  alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287\n  __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599\n  nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Bytes 16-127 of 3968 are uninitialized\n ...\n\nThis eliminates the leak issue by initializing the page allocated as\nbuffer using get_zeroed_page()."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/ioctl.c"],"versions":[{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"a94932381e8dae4117e9129b3c1282e18aa97b05","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"9c5034e9a0e03db8d5e9eabb176340259b5b97e4","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"d18db946cc6a394291539e030df32324285648f7","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"5bb105cc72beb9d51bf12f5c657336d2d35bdc5d","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"5f33b042f74fc9662eba17f4cd19b07d84bbc6c5","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"8a6550b365c0ce2e65905de57dcbfe1f7d629726","status":"affected","versionType":"git"},{"version":"003ff182fddde09ddfb8d079bbdb02f9d2122082","lessThan":"003587000276f81d0114b5ce773d80c119d8cb30","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/ioctl.c"],"versions":[{"version":"2.6.31","status":"affected"},{"version":"0","lessThan":"2.6.31","status":"unaffected","versionType":"semver"},{"version":"4.14.312","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.280","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.240","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.177","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.105","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.22","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2.9","lessThanOrEqual":"6.2.*","status":"unaffected","versionType":"semver"},{"version":"6.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"4.14.312"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"4.19.280"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"5.4.240"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"5.10.177"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"5.15.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"6.1.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"6.2.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31","versionEndExcluding":"6.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a94932381e8dae4117e9129b3c1282e18aa97b05"},{"url":"https://git.kernel.org/stable/c/9c5034e9a0e03db8d5e9eabb176340259b5b97e4"},{"url":"https://git.kernel.org/stable/c/8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6"},{"url":"https://git.kernel.org/stable/c/d18db946cc6a394291539e030df32324285648f7"},{"url":"https://git.kernel.org/stable/c/5bb105cc72beb9d51bf12f5c657336d2d35bdc5d"},{"url":"https://git.kernel.org/stable/c/5f33b042f74fc9662eba17f4cd19b07d84bbc6c5"},{"url":"https://git.kernel.org/stable/c/8a6550b365c0ce2e65905de57dcbfe1f7d629726"},{"url":"https://git.kernel.org/stable/c/003587000276f81d0114b5ce773d80c119d8cb30"}],"title":"nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()","x_generator":{"engine":"bippy-1.2.0"}}}}