What’s Vulnerable › Vulnerabilities
CVE-2023-34256
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-05-31 · updated 2026-06-17
- Weakness: CWE-125
Description
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
Affected products
- Debian Linux: 10.0
- Linux kernel: before 6.3.3 — fixed in 6.3.3
- SUSE Linux Enterprise: 12.0-sp5, 15.0-sp4, 15.0-sp5
How to fix
Upgrade to a fixed version: Linux kernel 6.3.3. Check the vendor advisory for mitigations.
References
- https://bugzilla.suse.com/show_bug.cgi?id=1211895
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321
- https://bugzilla.suse.com/show_bug.cgi?id=1211895
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321
Get alerted when CVE-2023-34256 or the next vulnerability affects your stack