CVE-2023-52588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-52588", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-02T21:55:42.570Z", "datePublished": "2024-03-06T06:45:21.925Z", "dateUpdated": "2026-08-05T09:10:30.257Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:30.257Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\")."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local f2fs paths (fallocate COLLAPSE/INSERT and F2FS_IOC_MOVE_RANGE \u2192 __clone_blkaddrs; write(2) to compressed files \u2192 set_cluster_dirty; F2FS_IOC_COMPRESS/DECOMPRESS_FILE \u2192 redirty_blocks), not via network or adjacent-link protocol handlers.\nAC:L - An unprivileged attacker can reliably create the inconsistent state by migrating blocks and forcing checkpoint via sync/syncfs/fsync; checkpoint deterministically skips non-gcing data pages (waits only on F2FS_WB_CP_DATA), and SPOR is an expected f2fs recovery condition on Android/embedded deployments rather than an attacker-uncontrollable race.\nPR:L - Triggering requires only ordinary write access to a file on a mounted f2fs volume (fallocate/write/ioctl with FMODE_WRITE); the compress/decompress and fallocate paths have no CAP_SYS_ADMIN check, and owners can enable compression via FS_IOC_SETFLAGS.\nUI:N - On typical f2fs deployments (e.g. Android userdata) the filesystem is already mounted; the attacker triggers migration and checkpointing entirely with their own syscalls, with no separate victim action required.\nS:U - Impact is confined to on-disk f2fs file/metadata integrity within the same kernel security authority; there is no VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:L - After SPOR, node metadata can reference newly allocated blocks that were never written, so reads return prior on-disk contents of those LFS blocks (potentially another user's deleted data), but without active cross-linking of live files this is limited disclosure rather than arbitrary memory read.\nI:H - Out-of-order persistency between migrated data and node pages causes silent, durable corruption or loss of file contents after sudden power-off, matching the fix description and other f2fs CP-persistence integrity bugs.\nA:H - Corrupted migrated/compressed clusters can permanently fail reads (wrong or undecompressible data), surface -EIO/-EFSCORRUPTED, and flag SBI_NEED_FSCK\u2014on Android/embedded f2fs userdata this is a durable availability loss requiring repair or data wipe."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "versions": [{"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7ea0f29d9fd84905051be020c0df7d557e286136", "status": "affected", "versionType": "git"}, {"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7c972c89457511007dfc933814c06786905e515c", "status": "affected", "versionType": "git"}, {"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "status": "affected", "versionType": "git"}, {"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "status": "affected", "versionType": "git"}, {"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "versions": [{"version": "3.8", "status": "affected"}, {"version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.77", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.16", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.4", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.7.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"}, {"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"}, {"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"}, {"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"}, {"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"}], "title": "f2fs: fix to tag gcing flag on page during block migration", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.145Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T19:26:08.215846Z", "id": "CVE-2023-52588", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:26:15.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.145Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-15T19:26:08.215846Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:26:12.962Z"}}], "cna": {"title": "f2fs: fix to tag gcing flag on page during block migration", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local f2fs paths (fallocate COLLAPSE/INSERT and F2FS_IOC_MOVE_RANGE \u2192 __clone_blkaddrs; write(2) to compressed files \u2192 set_cluster_dirty; F2FS_IOC_COMPRESS/DECOMPRESS_FILE \u2192 redirty_blocks), not via network or adjacent-link protocol handlers.\nAC:L - An unprivileged attacker can reliably create the inconsistent state by migrating blocks and forcing checkpoint via sync/syncfs/fsync; checkpoint deterministically skips non-gcing data pages (waits only on F2FS_WB_CP_DATA), and SPOR is an expected f2fs recovery condition on Android/embedded deployments rather than an attacker-uncontrollable race.\nPR:L - Triggering requires only ordinary write access to a file on a mounted f2fs volume (fallocate/write/ioctl with FMODE_WRITE); the compress/decompress and fallocate paths have no CAP_SYS_ADMIN check, and owners can enable compression via FS_IOC_SETFLAGS.\nUI:N - On typical f2fs deployments (e.g. Android userdata) the filesystem is already mounted; the attacker triggers migration and checkpointing entirely with their own syscalls, with no separate victim action required.\nS:U - Impact is confined to on-disk f2fs file/metadata integrity within the same kernel security authority; there is no VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:L - After SPOR, node metadata can reference newly allocated blocks that were never written, so reads return prior on-disk contents of those LFS blocks (potentially another user's deleted data), but without active cross-linking of live files this is limited disclosure rather than arbitrary memory read.\nI:H - Out-of-order persistency between migrated data and node pages causes silent, durable corruption or loss of file contents after sudden power-off, matching the fix description and other f2fs CP-persistence integrity bugs.\nA:H - Corrupted migrated/compressed clusters can permanently fail reads (wrong or undecompressible data), surface -EIO/-EFSCORRUPTED, and flag SBI_NEED_FSCK\u2014on Android/embedded f2fs userdata this is a durable availability loss requiring repair or data wipe."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7ea0f29d9fd84905051be020c0df7d557e286136", "versionType": "git"}, {"status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7c972c89457511007dfc933814c06786905e515c", "versionType": "git"}, {"status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "versionType": "git"}, {"status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "versionType": "git"}, {"status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "versionType": "git"}], "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"status": "unaffected", "version": "0", "lessThan": "3.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.77", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.16", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.4", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"}, {"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"}, {"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"}, {"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"}, {"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\")."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.149", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.77", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.16", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.4", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "3.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:30.257Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52588", "state": "PUBLISHED", "dateUpdated": "2026-08-05T09:10:30.257Z", "dateReserved": "2024-03-02T21:55:42.570Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-06T06:45:21.925Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7ea0f29d9fd84905051be020c0df7d557e286136", "status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "versionType": "git"}, {"lessThan": "7c972c89457511007dfc933814c06786905e515c", "status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "versionType": "git"}, {"lessThan": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "versionType": "git"}, {"lessThan": "b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "versionType": "git"}, {"lessThan": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "status": "affected", "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/compress.c", "fs/f2fs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"lessThan": "3.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.77", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.16", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "78D569F8-1D0B-426D-84B5-EFFE28C63F33", "versionEndExcluding": "5.15.149", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FA28946-970D-4F4D-B759-4E77B28809B5", "versionEndExcluding": "6.1.77", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5007D6A-4B58-423A-8A3A-A1A656A263C8", "versionEndExcluding": "6.6.16", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "848BC44C-9D25-4557-A50A-4B8BF310FA78", "versionEndExcluding": "6.7.4", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\")."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: f2fs: correcci\u00f3n para etiquetar el indicador gcing en la p\u00e1gina durante la migraci\u00f3n de bloques. Es necesario agregar el indicador gcing faltante en la p\u00e1gina durante la migraci\u00f3n de bloques, para garantizar que los datos migrados persistan durante el punto de control; de lo contrario, no estar\u00e1n disponibles. La persistencia del orden entre los datos y el nodo puede provocar da\u00f1os en los datos despu\u00e9s de SPOR. Se solucion\u00f3 un problema similar mediante el commit 2d1fe8a86bf5 (\"f2fs: correcci\u00f3n para etiquetar el indicador gcing en la p\u00e1gina durante la desfragmentaci\u00f3n del archivo\")."}], "id": "CVE-2023-52588", "lastModified": "2026-08-04T10:18:32.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52588", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-15T19:26:08.215846Z", "version": "2.0.3"}}]}, "published": "2024-03-06T07:15:07.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: f2fs: fix to tag gcing flag on page during block migration", "id": "2268329", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268329"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nf2fs: fix to tag gcing flag on page during block migration\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\").", "A vulnerability was found in the Linux kernel's f2fs component, caused by a missing gflag on a page during block migration, something that is necessary to guarantee migrate data is persisted during checkpoint. Without this flag, it is possible that the data may not be properly persisted and can lead to data corruption after a sudden power-off recovery (SPOR)."], "name": "CVE-2023-52588", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52588\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52588\nhttps://lore.kernel.org/linux-cve-announce/2024030644-CVE-2023-52588-619a@gregkh/T"], "statement": "Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.", "threat_severity": "Moderate"}

{}