CVE-2022-50273: f2fs: fix to do sanity check on destination blkaddr during recovery
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on destination blkaddr during recovery
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/showbug.cgi?id=216456
loop5: detected capacity change from 0 to 131072 F2FS-fs (loop5): recoverinode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recoverdata: ino = 6 (isize: recover) err = 0 F2FS-fs (loop5): recoverinode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recoverdata: ino = 6 (isize: recover) err = 0 F2FS-fs (loop5): recoverinode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recoverdata: ino = 6 (isize: recover) err = 0 F2FS-fs (loop5): Bitmap was wrongly set, blk:5634 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1013 at fs/f2fs/segment.c:2198 RIP: 0010:updatesitentry+0xa55/0x10b0 [f2fs] Call Trace: <TASK> f2fsdoreplaceblock+0xa98/0x1890 [f2fs] f2fsreplaceblock+0xeb/0x180 [f2fs] recoverdata+0x1a69/0x6ae0 [f2fs] f2fsrecoverfsyncdata+0x120d/0x1fc0 [f2fs] f2fsfillsuper+0x4665/0x61e0 [f2fs] mountbdev+0x2cf/0x3b0 legacygettree+0xed/0x1d0 vfsgettree+0x81/0x2b0 pathmount+0x47e/0x19d0 domount+0xce/0xf0 x64sysmount+0x12c/0x1a0 dosyscall64+0x38/0x90 entrySYSCALL64afterhwframe+0x63/0xcd
If we enable CONFIGF2FSCHECKFS config, it will trigger a kernel panic instead of warning.
The root cause is: in fuzzed image, SIT table is inconsistent with inode mapping table, result in triggering such warning during SIT table update.
This patch introduces a new flag DATAGENERICENHANCEUPDATE, w/ this flag, data block recovery flow can check destination blkaddr's validation in SIT table, and skip f2fsreplaceblock() to avoid inconsistent status.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bugzilla.kernel.org/show_bug.cgi?id=216456
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50273?
CVE-2022-50273 has a medium severity rating due to potential data integrity issues during recovery processes in the Linux kernel.
How do I fix CVE-2022-50273?
To mitigate CVE-2022-50273, update your Linux kernel to patched versions that address this vulnerability.
Which Linux kernel versions are affected by CVE-2022-50273?
CVE-2022-50273 impacts Linux kernel versions from 3.8 up to 6.0.3, excluding those with specific patches.
What type of vulnerability is CVE-2022-50273?
CVE-2022-50273 is classified as a data integrity vulnerability related to the F2FS filesystem in the Linux kernel.
Is CVE-2022-50273 exploitable remotely?
CVE-2022-50273 is not categorized as a remotely exploitable vulnerability; it requires local access.