In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid dirent corruption
As Al reported in link[1]:
f2fsrename() ... if (olddir != newdir && !whiteout) f2fssetlink(oldinode, olddirentry, olddirpage, newdir); else f2fsputpage(olddir_page, 0);
You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed to call f2fssetlink() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar
[ASSERT] (_chkdots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52444.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52444.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52444-1992f906",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5624a3c1b1ebc8991318e1cce2aa719542991024",
"target": {
"file": "fs/f2fs/namei.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 3401.0,
"function_hash": "310175774894176169448268116129945516781"
},
"signature_type": "Function",
"id": "CVE-2023-52444-694076ac",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5624a3c1b1ebc8991318e1cce2aa719542991024",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 3250.0,
"function_hash": "170739933676378549029880873038670852251"
},
"signature_type": "Function",
"id": "CVE-2023-52444-aabdb06d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0145860c20be6bae6785c7a2249577674702ac7",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 3321.0,
"function_hash": "296593862529164183136304735238960991736"
},
"signature_type": "Function",
"id": "CVE-2023-52444-f048f8c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02160112e6d45c2610b049df6eb693d7a2e57b46",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52444-f1c67fcd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0145860c20be6bae6785c7a2249577674702ac7",
"target": {
"file": "fs/f2fs/namei.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52444-f3dd3a18",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02160112e6d45c2610b049df6eb693d7a2e57b46",
"target": {
"file": "fs/f2fs/namei.c"
}
}
]