#VU90905 Reachable Assertion in Linux kernel - CVE-2023-52759

Vulnerability identifier: #VU90905

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52759

CWE-ID: CWE-617

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the qd_check_sync() function in fs/gfs2/quota.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/1c28dace66015b675a343b89b0c87abbfda05ff4
https://git.kernel.org/stable/c/b4deec69fe32b58dc5fb4ace52456ece85b75561
https://git.kernel.org/stable/c/2bb42a27a92ff3984c9fa5fbe128eced3ea693f2
https://git.kernel.org/stable/c/2a054b87a1b799b391e578597a42ee6e57a987ae
https://git.kernel.org/stable/c/5bfda356e903633d16ae1bac1ee38364e12628a3
https://git.kernel.org/stable/c/53fc16c1ad84f5467ec24341670b63aa759335d3
https://git.kernel.org/stable/c/212f112fe5e90e98eb8d48585682880dae139f4c
https://git.kernel.org/stable/c/119565e566f91ff3588ffcd5812f0c8061586c6b
https://git.kernel.org/stable/c/4c6a08125f2249531ec01783a5f4317d7342add5

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.