CVE-2023-4273 Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry

Medium 6.0 Published 9 Aug 2023 Updated 14 Oct 2026

A local privileged attacker can overflow the kernel stack via the exFAT driver, potentially causing a denial of service or privilege escalation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-4273?

CVE-2023-4273 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 9 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2023-4273?

It affects 8 products.

Linux distribution packages (4)

`kernel-livepatch-SLE15-SP4-RT_Update_11` SUSE:Linux Enterprise Live Patching 15 SP4	All versions	`2-150400.2.1`
`kernel-livepatch-SLE15-SP4_Update_16` SUSE:Linux Enterprise Live Patching 15 SP4	All versions	`2-150400.2.1`
`kernel-livepatch-SLE15-SP5-RT_Update_3` SUSE:Linux Enterprise Live Patching 15 SP5	All versions	`2-150500.2.1`
`kernel-livepatch-SLE15-SP5_Update_3` SUSE:Linux Enterprise Live Patching 15 SP5	All versions	`2-150500.2.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500s Firmware and 2 more.

How do I fix CVE-2023-4273?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-4273 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4273 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-27914, DEBIAN-CVE-2023-4273, GHSA-wm25-c777-f2h3, SUSE-SU-2023:3806-1, SUSE-SU-2023:3929-1, UBUNTU-CVE-2023-4273.