CVE-2022-49363: f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on block address in f2fsdozerorange()
As Yanming reported in bugzilla:
https://bugzilla.kernel.org/showbug.cgi?id=215894
I have encountered a bug in F2FS file system in kernel v5.17.
I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk
The kernel should enable CONFIGKASAN=y and CONFIGKASANINLINE=y. You can reproduce the bug by running the following commands:
kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fsinvalidateblocks+0x193/0x2d0 f2fsfallocate+0x2593/0x4a70 vfsfallocate+0x2a5/0xac0 ksysfallocate+0x35/0x70 x64sysfallocate+0x8e/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x44/0xae
The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fsfallocate(), it will cause panic when updating SIT with invalid blkaddr.
Let's fix the issue by adding sanity check on block address before updating SIT table with it.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the failure?
The issue requires an F2FS filesystem image whose inode block-mapping information is inconsistent with the Segment Information Table (SIT). A local user able to invoke fallocate against data on that filesystem can reach the vulnerable f2fs_fallocate path.
What is the observable impact on an affected system?
Updating the SIT with an invalid block address can trigger a kernel BUG in f2fs_invalidate_blocks, causing a kernel panic. The reported call trace reaches the failure through the fallocate system call.
Are ordinary F2FS filesystems affected by the reported trigger?
The reported root cause depends on a fuzzed or otherwise corrupted F2FS image with inconsistent metadata. The provided information does not establish that a consistent, ordinary F2FS filesystem triggers the issue.
How can administrators identify potentially exposed systems?
Systems using the Linux kernel with F2FS filesystems are the relevant population. Affected behavior may appear as a kernel BUG at fs/f2fs/segment.c:2291 with a call trace including f2fs_invalidate_blocks, f2fs_fallocate, vfs_fallocate, and ksys_fallocate.