LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53270: ext4: fix i_disksize exceeding i_size problem in paritally written case

In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_from_user_atomic(len) // copied < len ext4_da_write_end | ext4_update_i_disksize | new_i_size = pos + copied; | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize | generic_write_end | copied = block_write_end(copied, len) // copied = 0 | if (unlikely(copied < len)) | if (!PageUptodate(page)) | copied = 0; | if (pos + copied > inode->i_size) // return false if (unlikely(copied == 0)) goto again; if (unlikely(iov_iter_fault_in_readable(i, bytes))) { status = -EFAULT; break; } We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: ext4_dio_write_iter iomap_dio_rw __iomap_dio_rw // return err, length is not aligned to 512 ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4_file_write_iter+0xbc7 Call Trace: vfs_write+0x3b1 ksys_write+0x77 do_syscall_64+0x39 Fix it by updating 'copied' value before updating i_disksize just like ext4_write_inline_data_end() does. A reproducer can be found in the buganizer link below.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53270 is a Linux kernel ext4 filesystem flaw where a partial write can leave internal file size metadata inconsistent. The reported impact is availability: a local low-privileged user can trigger a kernel warning/Oops condition. It is not listed as KEV, and the provided sources do not show active exploitation.

Executive priority

Schedule remediation through normal kernel patch cycles, faster for shared Linux infrastructure. This is not supported as an internet-exposed remote compromise in the provided evidence, but it can affect system availability where local users or workloads can trigger the faulty path.

Technical view

In ext4 delayed allocation write handling, i_disksize could be updated before the final copied byte count was known. If the write later resolves to zero bytes, i_disksize can exceed i_size and trigger WARN_ON_ONCE during direct I/O inode extension handling. The fix updates copied before i_disksize, matching inline-data write behavior.

Likely exposure

Exposure is most relevant on Linux systems using ext4 with affected kernel versions or downstream builds missing the referenced stable fixes. The CVSS vector requires local access and low privileges, with no confidentiality or integrity impact claimed. Multi-user servers, shared compute, and container hosts deserve priority review.

Exploitation context

The source bundle mentions a reproducer exists, but does not provide public exploitation evidence. KEV is false. Treat this as a local availability issue unless vendor advisories or telemetry show otherwise. Do not assume remote exploitation from the supplied evidence.

Researcher notes

The key condition is i_disksize exceeding i_size after a partially written ext4 delayed-allocation write. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Affected-version data in the bundle is broad; confirm exact exposure through vendor backport status.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced stable ext4 fixes.
  • Prioritize shared systems where low-privileged local users can write to ext4 filesystems.
  • Check vendor guidance if your distribution backports fixes without changing kernel version strings.
  • Monitor kernel logs for ext4 warnings or Oops events on affected hosts.

Validation and detection

  • Inventory Linux kernel versions and identify systems using ext4 filesystems.
  • Confirm distribution packages include one of the referenced stable commits or an equivalent backport.
  • Review kernel logs for warnings involving ext4 file write or direct I/O paths.
  • Track vendor advisories for affected-version mapping specific to your distribution.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53270 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2023-53270Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux64769240bd07f446f83660bb143bb609d8ab4910, 64769240bd07f446f83660bb143bb609d8ab4910, 64769240bd07f446f83660bb143bb609d8ab4910, 64769240bd07f446f83660bb143bb609d8ab4910, 64769240bd07f446f83660bb143bb609d8ab4910unaffected
LinuxLinux2.6.27, 0, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.