CVE-2023-4273

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

• CWE-121
• CWE-787

• https://access.redhat.com/errata/RHSA-2023:6583
• https://access.redhat.com/security/cve/CVE-2023-4273Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2221609Issue Tracking, Patch, Third Party Advisory
• https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/Exploit, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2023:6583
• https://access.redhat.com/security/cve/CVE-2023-4273Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2221609Issue Tracking, Patch, Third Party Advisory
• https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/344H6HO6SSC4KT7PDFXSDIXKMKHISSGF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TYLSJ2SAI7RF56ZLQ5CQWCJLVJSD73Q/
• https://security.netapp.com/advisory/ntap-20231027-0002/
• https://www.debian.org/security/2023/dsa-5480
• https://www.debian.org/security/2023/dsa-5492

Published

Aug 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42724In gpu driver, there is a possible out of bounds read due to…4.4
• CVE-2023-42725In gpu driver, there is a possible out of bounds read due to…4.4
• CVE-2023-42726In TeleService, there is a possible out of bounds read due t…4.4
• CVE-2023-42727In gpu driver, there is a possible out of bounds write due t…4.4
• CVE-2023-42728In phasecheckserver, there is a possible out of bounds read …5.5
• CVE-2023-42729In ril service, there is a possible out of bounds write due …4.4
• CVE-2023-42730In IMS service, there is a possible way to write permission …5.5
• CVE-2023-42731In Gnss service, there is a possible out of bounds read due …4.4
• CVE-2023-42732In telephony service, there is a possible missing permission…5.5
• CVE-2023-42733In telephony service, there is a possible missing permission…5.5
• CVE-2023-42734In telephony service, there is a possible missing permission…5.5
• CVE-2023-42735In telephony service, there is a possible missing permission…4.4