Cloudanix VulnDB

CVE-2023-54132

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in handling certain disk-image files can make the computer suddenly crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Invalid clusterofs value in non-compact HEAD index of erofs image triggers out-of-bounds memory access during z_erofs_decompress_queue processing, causing kernel page fault and oops.

Why it matters to the business

Systems handling untrusted or attacker-supplied erofs images risk sudden kernel crashes that interrupt services, require reboots, and may lead to data corruption or loss of availability.

How an attack unfolds

An attacker creates a crafted erofs filesystem image containing a non-compact index with an out-of-range clusterofs value, then supplies the image through removable media, network shares, or container layers; when the victim kernel mounts or decompresses the image the erofs parser dereferences an invalid address and panics.

How to fix it

Upgrade the Linux kernel to a version containing commit 880c79bdb002b9d5b6940e52c2ad3829c2178207 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 880c79bdb002b9d5b6940e52c2ad3829c2178207; attempt to mount a test image with invalid clusterofs and verify no page fault occurs.

Typical attack path

  1. Generate malicious erofs image with invalid non-compact HEAD index clusterofs
  2. Deliver image to target via USB, network filesystem, or container image
  3. Victim system attempts to mount or read the image
  4. Kernel erofs worker thread processes decompression queue and faults

How to detect it

Search kernel logs and dmesg for oops messages referencing z_erofs_decompress_queue, erofs_worker, or page faults at addresses near fffff52101a3fff9; correlate with recent mount attempts of erofs filesystems.

  • z_erofs_decompress_queue
  • erofs_worker
  • BUG: unable to handle page fault for address: fffff52101a3fff9

What your security team should do

  • Apply the referenced kernel commit or newer release across all affected hosts
  • Restrict mounting of erofs images to trusted sources only
  • Monitor kernel logs for erofs-related oops entries until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: erofs: stop parsing non-compact HEAD index if clusterofs is invalid Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below: BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: <TASK> z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30 Note that normal images or images using compact indexes are not impacted. Let's fix this now. [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.19.0 5.4.243
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.118.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.118.1

Related vulnerabilities