Executive brief
The f2fs (Flash-Friendly File System) is a widely-used filesystem in the Linux kernel optimized for NAND flash storage. A flaw in the filesystem recovery and garbage collection code fails to validate metadata (summary table entries), allowing a malformed or corrupted filesystem image to trigger an out-of-bounds memory access during mount. This can cause a kernel crash or denial of service, potentially preventing systems from booting or operating normally.
Technical details
The vulnerability is a use-after-free (UAF) type memory safety issue occurring in the f2fs recovery path (recover_data → do_recover_data → check_index_in_prev_nodes → f2fs_data_blkaddr). The root cause is missing bounds validation on the ofs_in_node field from the SSA (Segment Summary Area) table during recovery and garbage collection. When a fuzzed or corrupted f2fs image contains an ofs_in_node value exceeding ADDRS_PER_PAGE (the maximum valid offset), the code performs an out-of-range memory access on a 4KB page. The vulnerability is triggered during filesystem mount/recovery without requiring authentication or special privileges. The patch adds sanity checks to validate ofs_in_node against maximum addressable entries before dereferencing memory, preventing the out-of-bounds access.
Affected products
- Linux Linux kernel Multiple versions (patch applied across 2.6.11-6.9 stable branches)
Timeline
- 2022-09-14: disclosed: Patch authored by Chao Yu
- 2022-10-21: patched: Stable backport integrated
- 2025-12-24: other: Published date in advisory