Vulnerability in Linux
CVE-2023-52569
In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending snapshots in the transaction commit path). So remove the BUG() call and do proper error handling. This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.002 (13.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 13.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Linux — versions 5.15.149, 5441532ffc9c8c9f7cab0f8722e6d60a0b5e1259, 6.5
- Linux Kernel — versions 6.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2023-52569?
- CVE-2023-52569 is a medium-severity vulnerability in Linux, classified under Reachable Assertion. CVSS score: 5.5/10. Published 2024-03-02.
- How severe is CVE-2023-52569?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2023-52569 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.