CVE-2023-53626

What it actually does

Double unlock in ext4 directory move operation leads to memory corruption in the Linux kernel.

Why it matters to the business

Local users on Linux systems using ext4 may trigger crashes or potential code execution, disrupting file system operations and system stability across many deployments.

How an attack unfolds

A local attacker with permissions to move directories on an ext4 filesystem triggers the double unlock condition during rename operations, resulting in memory corruption that can be leveraged for privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to version 5.4.238 or apply the fix from commit c16cbd8233d6c58fc488545393e49b5d55729990; also apply the corresponding fixes in 9.7.0 or 8.11.4 for any affected Solr packages.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed release and test directory move operations under load to ensure no double unlock occurs.

Typical attack path

1. Gain local access to a Linux system
2. Perform directory move or rename operations on ext4
3. Trigger the vulnerable ext4 code path to cause double unlock
4. Exploit resulting memory corruption

How to detect it

Inspect kernel logs for ext4-related warnings or unlock errors; review audit logs for unusual directory move activity by non-admin users.

What your security team should do

• Prioritize kernel upgrades on all ext4 systems within the next patch cycle
• Review local user permissions for directory modifications
• Monitor kernel update channels for backports to older stable trees