CVE-2023-4273

What it actually does

Stack-based buffer overflow in the Linux kernel exFAT driver's file name reconstruction function due to unbounded copying of directory entry name characters into a stack buffer, enabling memory corruption by a local privileged attacker.

Why it matters to the business

Linux systems using exFAT filesystems face risk of kernel-level memory corruption that could lead to system crashes, data loss, or escalation of local privileges on servers and endpoints.

How an attack unfolds

A local attacker with high privileges crafts a malicious exFAT directory containing specially formed long file name entries, mounts the filesystem, and triggers the reconstruction routine to overflow the kernel stack.

How to fix it

Upgrade the Linux kernel to a version containing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 or later; rebuild and reboot with the patched kernel; disable exFAT support if the filesystem is not required.

How to confirm the fix worked

Verify the running kernel source contains commit 6995e2de6891c724bfeb2db33d7b87775f913ad1; confirm the exFAT driver no longer performs unbounded stack copies for file name reconstruction; test mounting of crafted exFAT images under the updated kernel.

Typical attack path

1. Obtain local shell access with privileged (root-equivalent) credentials on a Linux host
2. Prepare or obtain an exFAT filesystem image containing oversized or malformed file name entries
3. Mount the malicious exFAT volume using the kernel driver
4. Trigger directory enumeration or file name reconstruction to induce the stack overflow

How to detect it

Review kernel logs for oops/panic messages referencing exFAT name reconstruction or stack overflow; inspect mount operations of exFAT volumes from untrusted sources; correlate with privileged user activity around filesystem access.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all Linux systems that mount exFAT volumes
• Audit exFAT usage and restrict mounting to trusted media only
• Monitor for kernel oops or panic events involving exFAT code paths