Executive brief
A flaw in the Linux kernel's f2fs (Flash-Friendly File System) allowed an inconsistent mount state when a multi-device f2fs image had one read-only secondary device but was remounted with read-write permissions. This inconsistency caused the kernel to crash (panic) during subsequent write operations, resulting in denial of service and potential data loss or system instability.
Technical details
The vulnerability is a missing device read-only status check in the f2fs remount logic. The vulnerable code in fs/f2fs/super.c checked only f2fs_sb_has_readonly() but failed to verify the hardware read-only status of all underlying block devices before allowing a remount with rw flags. An attacker with local access could set a secondary device as read-only (via blockdev --setro) and then remount the filesystem as read-write, bypassing the check. Subsequent write operations would trigger a kernel BUG in f2fs_write_inline_data(), crashing the system. The fix introduces f2fs_dev_is_readonly() to comprehensively check both software and hardware read-only conditions before permitting remount.
Affected products
- Linux Linux kernel multiple versions (patched in stable series from 5.3.y onwards)
Timeline
- 2025-12-30: disclosed: CVE-2023-54182 published
- 2023-04-12: patched: Fix committed to mainline (commit d78dfefcde9d311284434560d69c0478c55a657e)
- 2023-05-24: patched: Fix backported to stable kernels