LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53796: f2fs: fix information leak in f2fs_move_inline_dirents()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix information leak in f2fs_move_inline_dirents() When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block. This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk. This was found by running xfstest generic/435 on a KMSAN-enabled kernel.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can write uninitialized memory into an F2FS directory block during a directory format conversion. That may expose leftover kernel memory on disk. The sources do not provide CVSS, known exploitation, or confirmed real-world impact, so business urgency depends on whether F2FS is used.

Executive priority

Treat as a targeted kernel hygiene issue. Prioritize patching where F2FS is used, especially on devices or systems that share disk images, removable media, or forensic artifacts.

Technical view

In f2fs_move_inline_dirents(), converting an inline directory to a regular directory failed to initialize the entire directory block. The fix zero-initializes the block. The flaw was introduced by commit 4ec17d688d74 and found with xfstest generic/435 on a KMSAN-enabled kernel.

Likely exposure

Exposure is most likely on Linux systems using F2FS with affected kernel builds. Systems not using F2FS are unlikely to hit this path based on the provided description.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of active exploitation. The issue is an information leak to disk, not a described remote code execution path.

Researcher notes

Evidence supports an F2FS-specific uninitialized-memory-to-disk leak during inline directory conversion. The bundle lacks CVSS, CWE, exploit reports, and distro-specific fixed versions, so validation should focus on actual filesystem use and kernel provenance.

Mitigation direction

  • Update affected Linux kernels to vendor-supported builds containing the F2FS fix.
  • Check distribution advisories for backported fixes matching your deployed kernel branch.
  • Prioritize systems that mount or create F2FS filesystems.
  • Avoid relying on upstream commit hashes alone for packaged distro kernels.

Validation and detection

  • Inventory hosts and images for F2FS filesystem usage.
  • Map running kernel versions against distro security advisories and fixed builds.
  • Confirm patched source includes zero-initialization in the inline directory conversion path.
  • Review disk image handling where exposed F2FS data could leave trust boundaries.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53796 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0ca, 4ec17d688d74b6b7cb10043c57ff4818cde2b0caunaffected
LinuxLinux4.3, 0, 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.