Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow a local user to cause file system corruption. By performing specific file operations on compressed files, an attacker can trigger an inconsistency in how the system tracks data blocks. This leads to a corrupted file system state that may require manual repair or cause system instability and data loss.
Technical details
A vulnerability exists in the F2FS file system implementation within the Linux kernel where partial (unaligned) truncation of a compressed inode can lead to file system corruption. When an inode has the FI_COMPRESS_RELEASED flag set, the system assumes reserved blocks exist during truncation; however, if the truncation is not aligned to the cluster size, the valid block count is updated incorrectly without corresponding updates to .i_blocks or .total_valid_block_count. This results in a mismatch detected by fsck. An attacker with local access can exploit this by setting compression flags, releasing blocks, and then performing a specific truncate operation. The fix enforces cluster-size aligned truncation for released compressed inodes.
Affected products
- Linux Linux Kernel 5.14 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4
Timeline
- 2024-05-10: patched: Initial patch authored by Chao Yu
- 2024-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee
- https://git.kernel.org/stable/c/3ccf5210dc941a7aa0180596ac021568be4d35ec
- https://git.kernel.org/stable/c/5268241b41b1c5d0acca75e9b97d4fd719251c8c
- https://git.kernel.org/stable/c/8acae047215024d1ac499b3c8337ef1b952f160b
- https://git.kernel.org/stable/c/9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d
- https://git.kernel.org/stable/c/b8962cf98595d1ec62f40f23667de830567ec8bc
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html