LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54132: erofs: stop parsing non-compact HEAD index if clusterofs is invalid

In the Linux kernel, the following vulnerability has been resolved: erofs: stop parsing non-compact HEAD index if clusterofs is invalid Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below: BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: <TASK> z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30 Note that normal images or images using compact indexes are not impacted. Let's fix this now. [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54132 is a Linux kernel EROFS filesystem bug. A specially crafted EROFS image can trigger a kernel page fault during decompression. The source says normal images and compact-index images are not affected. Business impact is mainly stability and denial-of-service risk where systems process or mount untrusted EROFS images.

Executive priority

Treat as a targeted stability risk, not a confirmed internet-scale emergency. Prioritize patching systems that handle filesystem images, appliances, containers, embedded builds, or untrusted media using EROFS. Routine kernel update cycles may be sufficient for systems with no EROFS exposure.

Technical view

The resolved kernel issue stops parsing a non-compact HEAD index when clusterofs is invalid. Syzbot produced an image with clusterofs 33024, outside the valid 0 to lclustersize-1 range, leading to a supervisor read page fault in z_erofs_decompress_queue. Fixes are represented by multiple Linux stable commits.

Likely exposure

Exposure is most likely on Linux systems using EROFS, especially where untrusted or externally supplied EROFS images may be mounted or parsed. Systems not using EROFS, or only using normal images or compact indexes as described by the source, appear less exposed.

Exploitation context

The public source describes syzbot-generated crafted image testing, not real-world exploitation. The CVE is not listed as KEV in the provided bundle. No public source here supports active exploitation claims.

Researcher notes

Severity and CVSS are not provided in the source bundle. The record’s affected version data is sparse and commit-oriented, so validate through distribution advisories and kernel changelogs. Do not assume privilege escalation; the provided evidence shows a kernel fault from malformed EROFS metadata.

Mitigation direction

  • Identify Linux systems with EROFS enabled or used in images and appliances.
  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • Avoid mounting or processing untrusted EROFS images until patched.
  • Check Linux vendor advisories for exact fixed package versions.

Validation and detection

  • Inventory kernel versions against the affected version data in the CVE record.
  • Confirm whether EROFS is enabled and used in production workflows.
  • Verify installed kernel includes the relevant upstream stable fix commit.
  • Review crash logs for EROFS-related kernel oops events.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54132 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1d, 02827e1796b33f1794966f5c3101f8da2dfa9c1dunaffected
LinuxLinux4.19, 0, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.