LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53777: erofs: kill hooked chains to avoid loops on deduplicated compressed images

In the Linux kernel, the following vulnerability has been resolved: erofs: kill hooked chains to avoid loops on deduplicated compressed images After heavily stressing EROFS with several images which include a hand-crafted image of repeated patterns for more than 46 days, I found two chains could be linked with each other almost simultaneously and form a loop so that the entire loop won't be submitted. As a consequence, the corresponding file pages will remain locked forever. It can be _only_ observed on data-deduplicated compressed images. For example, consider two chains with five pclusters in total: Chain 1: 2->3->4->5 -- The tail pcluster is 5; Chain 2: 5->1->2 -- The tail pcluster is 2. Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link to Chain 2 at the same time with pcluster 2. Since hooked chains are all linked locklessly now, I have no idea how to simply avoid the race. Instead, let's avoid hooked chains completely until I could work out a proper way to fix this and end users finally tell us that it's needed to add it back. Actually, this optimization can be found with multi-threaded workloads (especially even more often on deduplicated compressed images), yet I'm not sure about the overall system impacts of not having this compared with implementation complexity.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53777 is a Linux kernel EROFS issue where certain deduplicated compressed filesystem images can trigger a loop in internal processing. The described impact is files pages staying locked forever, which points to availability risk rather than data theft. The source does not provide a CVSS score or evidence of active exploitation.

Executive priority

Treat this as a targeted availability issue. Prioritize systems that mount EROFS images from less-trusted sources or support device, container, or image-processing workflows. It is not KEV-listed and has no supplied CVSS score, so broad emergency action is not supported by the provided evidence.

Technical view

The EROFS decompression path could link two lockless hooked chains to each other on data-deduplicated compressed images, preventing the loop from being submitted. Kernel notes say affected file pages remain locked forever. The fix removes hooked chains until a safer implementation exists. Affected version data is limited and should be verified against distribution kernels.

Likely exposure

Exposure is most likely on Linux systems that support or mount EROFS data-deduplicated compressed images. Risk is higher where images come from build pipelines, devices, or users outside strict trust boundaries. The bundle lists Linux 6.0, 6.1.39, 6.3.13, 6.4.4, and 6.5 as affected, but version data is incomplete.

Exploitation context

No cited source says this is being exploited in the wild, and it is not marked KEV. The upstream description references a hand-crafted repeated-pattern image and a long stress test. That supports a plausible denial-of-service condition, but not a confirmed public exploit or privilege escalation.

Researcher notes

The core condition is a race between lockless hooked chains on deduplicated compressed EROFS images. Upstream chose to remove the optimization rather than preserve the behavior. The source bundle does not include CWE, CVSS, exploitability scoring, or detailed product-specific downstream affected ranges.

Mitigation direction

  • Check vendor or distribution kernel advisories for CVE-2023-53777 fixes.
  • Update affected Linux kernels to builds containing the referenced stable commits.
  • Avoid mounting untrusted EROFS deduplicated compressed images until patched.
  • Restrict EROFS image ingestion to trusted build and release pipelines.
  • Track upstream Linux stable guidance if distribution patches are unavailable.

Validation and detection

  • Inventory Linux kernel versions across systems that may use EROFS.
  • Confirm whether EROFS support is enabled or loaded on relevant hosts.
  • Identify workflows that mount or process deduplicated compressed EROFS images.
  • Map installed kernels against distribution advisories and the upstream stable commits.
  • Review system logs for unexplained hangs around EROFS image access.
Prepared
Confidence
medium
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53777 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux267f2492c8f71dac44399988b510f9bf6b074a51, 267f2492c8f71dac44399988b510f9bf6b074a51, 267f2492c8f71dac44399988b510f9bf6b074a51, 267f2492c8f71dac44399988b510f9bf6b074a51unaffected
LinuxLinux6.0, 0, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.