CVE-2023-2124

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-15 · updated 2026-06-17
Weakness: CWE-787

Description

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

Affected products

Debian Linux: 11.0, 12.0
Linux kernel: before 6.4 — fixed in 6.4
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 6.4. Check the vendor advisory for mitigations.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://security.netapp.com/advisory/ntap-20230622-0010/
https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e
https://www.debian.org/security/2023/dsa-5448
https://www.debian.org/security/2023/dsa-5480
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://security.netapp.com/advisory/ntap-20230622-0010/
https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e
https://www.debian.org/security/2023/dsa-5448
https://www.debian.org/security/2023/dsa-5480

Get alerted when CVE-2023-2124 or the next vulnerability affects your stack