Block Device Zeroing Vulnerability in Linux Kernel Affecting Various Userspace Programs

CVE-2023-54317

What is CVE-2023-54317?

A vulnerability in the Linux kernel allows for the corruption of the zero page when using the dm-flakey module with corrupt bio writes. This leads to inconsistencies in memory management—specifically, the memory returned by mmap may not be as expected, causing the calloc function to return non-zeroed memory. As a result, this can trigger crashes in multiple userspace applications relying on the assumption that zero pages remain unaltered. To mitigate this issue, a fix was implemented to verify the legitimacy of the zero page before any operations are performed, thereby ensuring stability in memory allocation.

References