CVE-2024-53221: f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix null-ptr-deref in f2fssubmitpagebio()
There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bioalloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fssubmitpagebio+0x126/0x8b0 [f2fs] getmetapage+0x1d4/0x920 [f2fs] getcheckpointversion.constprop.0+0x2b/0x3c0 [f2fs] validatecheckpoint+0xac/0x290 [f2fs] f2fsgetvalidcheckpoint+0x207/0x950 [f2fs] f2fsfillsuper+0x1007/0x39b0 [f2fs] mountbdev+0x183/0x250 legacygettree+0xf4/0x1e0 vfsgettree+0x88/0x340 donewmount+0x283/0x5e0 pathmount+0x2b2/0x15b0 x64sysmount+0x1fe/0x270 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Above issue happens as the biset of the f2fs file system is not initialized before register "f2fsfstype". To address above issue just register "f2fsfstype" at the last in initf2fsfs(). Ensure that all f2fs file system resources are initialized.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Update init_f2fs_fs() so that f2fs_fs_type is registered only after all f2fs file system resources have been initialized.
Linux kernel f2fs f2fs_fs_type registration order in init_f2fs_fs() = Register f2fs_fs_type last, after all f2fs file system resources are initialized
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53221?
CVE-2024-53221 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-53221?
To fix CVE-2024-53221, update the Linux kernel to a version later than 6.12.2 or apply the relevant patches available.
What versions of the Linux kernel are affected by CVE-2024-53221?
CVE-2024-53221 affects Linux kernel versions between 5.6 and 6.12.2.
What is the nature of the issue described in CVE-2024-53221?
The issue in CVE-2024-53221 involves a null pointer dereference in the f2fs_submit_page_bio() function.
Is CVE-2024-53221 exploitable remotely?
CVE-2024-53221 is not specifically documented as a remote vulnerability but may be exploited in specific conditions involving concurrent operations.