CVE-2022-50270: f2fs: fix the assign logic of iocb
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix the assign logic of iocb
commit 18ae8d12991b ("f2fs: show more DIO information in tracepoint") introduces iocb field in 'f2fsdirectIOenter' trace event And it only assigns the pointer and later it accesses its field in trace print log.
Unable to handle kernel paging request at virtual address ffffffc04cef3d30 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits
pc : tracerawoutputf2fsdirectIOenter+0x54/0xa4 lr : tracerawoutputf2fsdirectIOenter+0x2c/0xa4 sp : ffffffc0443cbbd0 x29: ffffffc0443cbbf0 x28: ffffff8935b120d0 x27: ffffff8935b12108 x26: ffffff8935b120f0 x25: ffffff8935b12100 x24: ffffff8935b110c0 x23: ffffff8935b10000 x22: ffffff88859a936c x21: ffffff88859a936c x20: ffffff8935b110c0 x19: ffffff8935b10000 x18: ffffffc03b195060 x17: ffffff8935b11e76 x16: 00000000000000cc x15: ffffffef855c4f2c x14: 0000000000000001 x13: 000000000000004e x12: ffff0000ffffff00 x11: ffffffef86c350d0 x10: 00000000000010c0 x9 : 000000000fe0002c x8 : ffffffc04cef3d28 x7 : 7f7f7f7f7f7f7f7f x6 : 0000000002000000 x5 : ffffff8935b11e9a x4 : 0000000000006250 x3 : ffff0a00ffffff04 x2 : 0000000000000002 x1 : ffffffef86a0a31f x0 : ffffff8935b10000 Call trace: tracerawoutputf2fsdirectIOenter+0x54/0xa4 printtracefmt+0x9c/0x138 printtraceline+0x154/0x254 tracingreadpipe+0x21c/0x380 vfsread+0x108/0x3ac ksysread+0x7c/0xec arm64sysread+0x20/0x30 invokesyscall+0x60/0x150 el0svccommon.llvm.1237943816091755067+0xb8/0xf8 doel0svc+0x28/0xa0
Fix it by copying the required variables for printing and while at it fix the similar issue at some other places in the same file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (f2fs)to a version that resolves this vulnerability.Patch 18ae8d12991b
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What systems or activity are relevant to this issue?
The flaw is in F2FS direct-I/O trace handling, where the f2fs_direct_IO_enter trace event later accesses an iocb field after only the pointer was assigned. Systems using F2FS and exercising this trace path are the relevant exposure scope described.
What evidence could indicate that this issue has occurred?
The supplied crash report shows a kernel paging request during trace_raw_output_f2fs_direct_IO_enter. A kernel fault or stack trace naming that function is an indicator consistent with this issue.