CVE-2025-38677: f2fs: fix to avoid out-of-boundary access in dnode page
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid out-of-boundary access in dnode page
As Jiaming Zhang reported:
<TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x1c1/0x2a0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0x17e/0x800 mm/kasan/report.c:480 kasanreport+0x147/0x180 mm/kasan/report.c:593 datablkaddr fs/f2fs/f2fs.h:3053 [inline] f2fsdatablkaddr fs/f2fs/f2fs.h:3058 [inline] f2fsgetdnodeofdata+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fsreserveblock+0x53/0x310 fs/f2fs/data.c:1195 preparewritebegin fs/f2fs/data.c:3395 [inline] f2fswritebegin+0xf39/0x2190 fs/f2fs/data.c:3594 genericperformwrite+0x2c7/0x910 mm/filemap.c:4112 f2fsbufferedwriteiter fs/f2fs/file.c:4988 [inline] f2fsfilewriteiter+0x1ec8/0x2410 fs/f2fs/file.c:5216 newsyncwrite fs/readwrite.c:593 [inline] vfswrite+0x546/0xa90 fs/readwrite.c:686 ksyswrite+0x149/0x250 fs/readwrite.c:738 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xf3/0x3d0 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fsgetdnodeofdata(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that getdnodeaddr() returns 360, then it tries to access page address from 360 + 934 4 = 4096 w/ 4 bytes.
To fix this issue, let's add sanity check for node id of all direct nodes during f2fsgetdnodeofdata().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a sanity check for the node ID of all direct nodes during f2fs_get_dnode_of_data() to prevent out-of-boundary access in a dnode page.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38677?
CVE-2025-38677 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38677?
To address CVE-2025-38677, update your Linux kernel to a version that includes the patch provided by the Linux maintainers.
What happens if CVE-2025-38677 is exploited?
Exploitation of CVE-2025-38677 could potentially lead to out-of-bound memory access, resulting in kernel crashes or unauthorized access.
Is CVE-2025-38677 present in all Linux kernel versions?
CVE-2025-38677 affects multiple versions of the Linux kernel, so it is important to verify the version you are using.
Who reported CVE-2025-38677?
CVE-2025-38677 was reported by researcher Jiaming Zhang.