CVE-2024-53218: f2fs: fix race in concurrent f2fs_stop_gc_thread
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix race in concurrent f2fsstopgcthread
In my test case, concurrent calls to f2fs shutdown report the following stack trace:
Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 678 Comm: f2fsrepshutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85 Call Trace: <TASK> ? showregs+0x8b/0xa0 ? diebody+0x26/0xa0 ? dieaddr+0x54/0x90 ? excgeneralprotection+0x24b/0x5c0 ? asmexcgeneralprotection+0x26/0x30 ? kthreadstop+0x46/0x390 f2fsstopgcthread+0x6c/0x110 f2fsdoshutdown+0x309/0x3a0 f2fsiocshutdown+0x150/0x1c0 f2fsioctl+0xffd/0x2ac0 f2fsioctl+0x76/0xe0 vfsioctl+0x23/0x60 x64sysioctl+0xce/0xf0 x64syscall+0x2b1b/0x4540 dosyscall64+0xa7/0x240 entrySYSCALL64afterhwframe+0x76/0x7e
The root cause is a race condition in f2fsstopgcthread() called from different f2fs shutdown paths:
[CPU0] [CPU1] ---------------------- ----------------------- f2fsstopgcthread f2fsstopgcthread gcth = sbi->gcthread gcth = sbi->gcthread kfree(gcth) sbi->gcthread = NULL < gcth != NULL > kthreadstop(gcth->f2fsgctask) //UAF
The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in f2fsstopgcthread()") attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions.
Fix it by converting to write lock of sumount in f2fsdoshutdown().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53218?
CVE-2024-53218 has a moderate severity level as it involves a race condition that can lead to a general protection fault.
What software versions are affected by CVE-2024-53218?
CVE-2024-53218 affects multiple versions of the Linux kernel, specifically versions up to 5.10.226-1 and 6.1.128-1.
How do I fix CVE-2024-53218?
To resolve CVE-2024-53218, update the Linux kernel to version 6.12.12-1 or later.
What is the nature of the issue in CVE-2024-53218?
CVE-2024-53218 involves a race condition in the f2fs filesystem during concurrent shutdown operations.
Can CVE-2024-53218 lead to data loss?
While CVE-2024-53218 primarily results in a crash, it may indirectly lead to data loss if the system is improperly shut down during operations.