{"id":"CVE-2023-53035","summary":"nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()\n\nThe ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a\nmetadata array to/from user space, may copy uninitialized buffer regions\nto user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO\nand NILFS_IOCTL_GET_CPINFO.\n\nThis can occur when the element size of the user space metadata given by\nthe v_size member of the argument nilfs_argv structure is larger than the\nsize of the metadata element (nilfs_suinfo structure or nilfs_cpinfo\nstructure) on the file system side.\n\nKMSAN-enabled kernels detect this issue as follows:\n\n BUG: KMSAN: kernel-infoleak in instrument_copy_to_user\n include/linux/instrumented.h:121 [inline]\n BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n  _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  copy_to_user include/linux/uaccess.h:169 [inline]\n  nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Uninit was created at:\n  __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572\n  alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287\n  __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599\n  nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Bytes 16-127 of 3968 are uninitialized\n ...\n\nThis eliminates the leak issue by initializing the page allocated as\nbuffer using get_zeroed_page().","modified":"2026-04-11T12:46:39.923111Z","published":"2025-05-02T15:54:54.876Z","related":["SUSE-SU-2025:01918-1","SUSE-SU-2025:01966-1","SUSE-SU-2025:02173-1","SUSE-SU-2025:02262-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53035.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/003587000276f81d0114b5ce773d80c119d8cb30"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5bb105cc72beb9d51bf12f5c657336d2d35bdc5d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5f33b042f74fc9662eba17f4cd19b07d84bbc6c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8a6550b365c0ce2e65905de57dcbfe1f7d629726"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9c5034e9a0e03db8d5e9eabb176340259b5b97e4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a94932381e8dae4117e9129b3c1282e18aa97b05"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d18db946cc6a394291539e030df32324285648f7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53035.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53035"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"003ff182fddde09ddfb8d079bbdb02f9d2122082"},{"fixed":"a94932381e8dae4117e9129b3c1282e18aa97b05"},{"fixed":"9c5034e9a0e03db8d5e9eabb176340259b5b97e4"},{"fixed":"8f5cbf6a8c0e19b062b829c5b7aca01468bb57f6"},{"fixed":"d18db946cc6a394291539e030df32324285648f7"},{"fixed":"5bb105cc72beb9d51bf12f5c657336d2d35bdc5d"},{"fixed":"5f33b042f74fc9662eba17f4cd19b07d84bbc6c5"},{"fixed":"8a6550b365c0ce2e65905de57dcbfe1f7d629726"},{"fixed":"003587000276f81d0114b5ce773d80c119d8cb30"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53035.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.31"},{"fixed":"4.14.312"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.19.280"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.240"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.177"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.105"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53035.json"}}],"schema_version":"1.7.5"}