LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54062: ext4: fix invalid free tracking in ext4_xattr_move_to_block()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum. However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored. So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel ext4 bug in extended attribute handling. Under specific xattr movement conditions, the kernel may free the wrong kind of memory or fail to free memory. The provided sources do not give CVSS, CWE, impact severity, or confirmed exploitation.

Executive priority

Track and remediate through normal kernel patch management unless vendor guidance raises severity. The business urgency is uncertain because impact scoring and exploitation evidence are absent, but kernel memory bugs on shared Linux infrastructure deserve timely handling.

Technical view

In ext4_xattr_move_to_block(), the code checked entry->e_value_inum after the xattr entry pointer was no longer valid. That could cause kvfree() on memory not allocated by kvmalloc(), or skip freeing memory that should be released. Kernel stable commits record the fix.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds with ext4 filesystems and extended attribute activity. The source bundle lists Linux kernel version and commit identifiers, but the simplified version data is ambiguous and should be checked against vendor kernel advisories.

Exploitation context

The bundle says KEV is false and provides no cited evidence of active exploitation, public exploit code, or weaponized attacks. Treat this as a kernel memory-management flaw requiring patch tracking, not as confirmed exploited-in-the-wild activity.

Researcher notes

The key review area is ext4 extended attributes, especially movement of xattr values stored in external inodes. Source evidence supports an invalid lifetime/free-tracking bug, but does not establish reachability, privilege requirements, crash reliability, or security impact beyond memory misuse.

Mitigation direction

  • Identify Linux kernels running on ext4-backed systems.
  • Compare installed kernel builds against vendor advisories for CVE-2023-54062.
  • Apply kernel updates containing the referenced ext4 stable fixes.
  • Prioritize internet-facing, multi-user, and container-host systems first.
  • If patches are unavailable, follow distribution-specific mitigation guidance.

Validation and detection

  • Inventory kernel versions and distribution backport levels.
  • Confirm ext4 usage on production and shared systems.
  • Review vendor changelogs for the referenced ext4 xattr fix.
  • Check vulnerability scanner logic for backported kernel fixes.
  • Document systems deferred from patching and compensating controls.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54062 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc7851208abffe5ae4deb01cf48763911dc14fc67, f5cdc6a7339f250d44d4d469ed7a474ac0d6c7a7, 3b28c799a1334adb5a19f42f03abe0d8cbb05938, d738789ae9ec47d3458a008788f3cdc862ebf0cb, a6744e14ce7045ab1a728bde9595f62fbd39f1d2, 8b6d06b3be7648b3b0f428558293ddf6e2cb94bf, d2efaf8c870c7067b8d1779773134f3481cd8f68, 1e9d62d252812575ded7c620d8fc67c32ff06c16, 1e9d62d252812575ded7c620d8fc67c32ff06c16, 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3unaffected
LinuxLinux6.3, 0, 4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.