In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid use f2fsbugon() in f2fsnewnode_page()
As Dipanjan Das mail.dipanjan.das@gmail.com reported, syzkaller found a f2fs bug as below:
RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeall_xattrs fs/f2fs/xattr.c:487 [inline] __f2fssetxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fssetxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fsxattrgeneric_set+0x133/0x170 fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfssetxattrnoperm+0x125/0x5f0 fs/xattr.c:216 __vfssetxattrlocked+0x1cf/0x260 fs/xattr.c:277 vfssetxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 pathsetxattr+0x1a7/0x1d0 fs/xattr.c:630 __dosyslsetxattr fs/xattr.c:653 [inline] __sesyslsetxattr fs/xattr.c:649 [inline] __x64syslsetxattr+0xbd/0x150 fs/xattr.c:649 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x46/0xb0
NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULLADDR, it may trigger BUGON() in f2fsnewnode_page(), fix it.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50013.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-07282408",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1288.0,
"function_hash": "247165649679920793572031278308868285308"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@141170b759e03958f296033bb7001be62d1d363b"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-072cf795",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43ce0a0bda2c54dad91d5a1943554eed9e050f55"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-161a9f4a",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a01e45b925a0bc9718eccd33e5920f1a4e44caf"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-1eefac72",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@800ba8979111184d5194f4233cc83afe683efc54"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-2c5d629a",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@141170b759e03958f296033bb7001be62d1d363b"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-308afeec",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1280.0,
"function_hash": "56692010914144628356742961163838706329"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a01e45b925a0bc9718eccd33e5920f1a4e44caf"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-58a059b0",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1280.0,
"function_hash": "56692010914144628356742961163838706329"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29e734ec33ae4bd7de4018fb0fb0eec808c36b92"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-5a3d1e75",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1280.0,
"function_hash": "56692010914144628356742961163838706329"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@800ba8979111184d5194f4233cc83afe683efc54"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-7d2726a2",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1273.0,
"function_hash": "261413957216014258255869417608124134932"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbfad62b29e9f8f1c1026a806c9e064ec2a7c342"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-8cb0884a",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbfad62b29e9f8f1c1026a806c9e064ec2a7c342"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-50013-a175f2ca",
"target": {
"file": "fs/f2fs/node.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"339662730609439931511561432130900711617",
"33839611145285845482628273672002036930",
"187843085918504850891507849742152720731",
"265694079840933126208830295210480257510"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29e734ec33ae4bd7de4018fb0fb0eec808c36b92"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-50013-a8556de6",
"target": {
"file": "fs/f2fs/node.c",
"function": "f2fs_new_node_page"
},
"digest": {
"length": 1288.0,
"function_hash": "247165649679920793572031278308868285308"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43ce0a0bda2c54dad91d5a1943554eed9e050f55"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50013.json"