182 lines
11 KiB
JSON
182 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-54182",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-30T12:06:44.497Z",
|
|
"datePublished": "2025-12-30T12:08:53.092Z",
|
|
"dateUpdated": "2026-08-05T09:17:51.173Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:17:51.173Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet's introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n f2fs_write_data_pages+0x2e/0x40 [f2fs]\n do_writepages+0xd3/0x1b0\n __writeback_single_inode+0x5b/0x420\n writeback_sb_inodes+0x236/0x5a0\n __writeback_inodes_wb+0x56/0xf0\n wb_writeback+0x2a3/0x490\n wb_do_writeback+0x2b2/0x330\n wb_workfn+0x6a/0x260\n process_one_work+0x270/0x5e0\n worker_thread+0x52/0x3e0\n kthread+0xf4/0x120\n ret_from_fork+0x29/0x50"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached through local filesystem operations — a mount/remount syscall on a local block device followed by ordinary file writes on the mounted f2fs volume. There is no network-facing component in fs/f2fs/super.c or the writeback path.\nAC:L - Once a multi-device f2fs volume with a read-only secondary device has been remounted read-write, writing any file larger than MAX_INLINE_DATA deterministically drives f2fs_write_inline_data() into f2fs_bug_on(sbi, page->index) with 100% reliability. There is no race to win and no memory layout to groom.\nPR:L - The final trigger requires only an unprivileged local user with write access to the mounted filesystem — the inconsistent RW state is created by the kernel wrongly accepting a remount that mount(8) itself flagged as write-protected, which an admin will naturally attempt after seeing the \"source write-protected, mounted read-only\" warning. No capability is needed to issue the writes that panic the kernel.\nUI:N - No victim action is needed at exploitation time; the attacker simply writes to a file and the writeback kworker hits the BUG asynchronously. The vulnerable mount state is a pre-existing system condition, not an interaction the attacker must induce.\nS:U - The impact is confined to the kernel and the affected filesystem within the same security authority — there is no VM, sandbox, or IOMMU boundary crossed.\nC:N - All data movement in the affected paths (f2fs_do_read_inline_data, f2fs_truncate_inline_inode, f2fs_write_inline_data) is bounded by MAX_INLINE_DATA(inode) inside the inode's own node page, so there is no out-of-bounds read, no uninitialized memory exposure, and no cross-file disclosure.\nI:H - The inconsistent mount lets f2fs_convert_inline_inode() silently skip conversion, so an inode retains FI_INLINE_DATA while holding data blocks past index 0; the WARN path then memcpy's the wrong page into the inline data area and writes to the read-only member device are rejected by bio_check_ro(), producing on-disk data and metadata corruption, checkpoint errors, and a filesystem flagged SBI_NEED_FSCK.\nA:H - With CONFIG_F2FS_CHECK_FS the assertion is a hard BUG_ON that panics the kernel from the writeback kworker (the exact \"kernel BUG at fs/f2fs/inline.c:258\" reported in the fix). Even without it, the resulting I/O failures on the read-only device drive the filesystem into a checkpoint-error state, taking the volume offline."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/f2fs/f2fs.h",
|
|
"fs/f2fs/super.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "f824deb54b683165b953371a0529446c723ef6d6",
|
|
"lessThan": "e2759a59a4cc96af712084e9db7065c858c4fe9f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f824deb54b683165b953371a0529446c723ef6d6",
|
|
"lessThan": "e05d63f8b48aad4613bd582c945bee41e2dd7255",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f824deb54b683165b953371a0529446c723ef6d6",
|
|
"lessThan": "da8c535b28696017e5d1532d12ea78e836432d9e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f824deb54b683165b953371a0529446c723ef6d6",
|
|
"lessThan": "d78dfefcde9d311284434560d69c0478c55a657e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/f2fs/f2fs.h",
|
|
"fs/f2fs/super.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.113",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.30",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.4",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.15.113"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.1.30"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.3.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"
|
|
}
|
|
],
|
|
"title": "f2fs: fix to check readonly condition correctly",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |