In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid dirent corruption
As Al reported in link[1]:
f2fsrename() ... if (olddir != newdir && !whiteout) f2fssetlink(oldinode, olddirentry, olddirpage, newdir); else f2fsputpage(olddir_page, 0);
You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed to call f2fssetlink() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar
[ASSERT] (_chkdots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f100ba617d8be6c98a68f3744ef7617082975b77",
"id": "CVE-2023-52444-179b2d1c",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5624a3c1b1ebc8991318e1cce2aa719542991024",
"id": "CVE-2023-52444-1992f906",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fb4867f4405aea8c0519d7d188207f232a57862",
"id": "CVE-2023-52444-44520074",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3216.0,
"function_hash": "289164426613562770567558386958842538701"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3c0b49aaa12a61d560528f5d605029ab57f0728",
"id": "CVE-2023-52444-53a75b5c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3216.0,
"function_hash": "289164426613562770567558386958842538701"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fb4867f4405aea8c0519d7d188207f232a57862",
"id": "CVE-2023-52444-5878c94c",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5624a3c1b1ebc8991318e1cce2aa719542991024",
"id": "CVE-2023-52444-694076ac",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3401.0,
"function_hash": "310175774894176169448268116129945516781"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53edb549565f55ccd0bdf43be3d66ce4c2d48b28",
"id": "CVE-2023-52444-69c16aa1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3216.0,
"function_hash": "289164426613562770567558386958842538701"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0145860c20be6bae6785c7a2249577674702ac7",
"id": "CVE-2023-52444-aabdb06d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3250.0,
"function_hash": "170739933676378549029880873038670852251"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f100ba617d8be6c98a68f3744ef7617082975b77",
"id": "CVE-2023-52444-b28df114",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3237.0,
"function_hash": "62802523090567227422997160204342361417"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53edb549565f55ccd0bdf43be3d66ce4c2d48b28",
"id": "CVE-2023-52444-c264c4c7",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3c0b49aaa12a61d560528f5d605029ab57f0728",
"id": "CVE-2023-52444-c425d761",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f866885e147d33efc497f1095f35b2ee5ec7310",
"id": "CVE-2023-52444-e35b178b",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f866885e147d33efc497f1095f35b2ee5ec7310",
"id": "CVE-2023-52444-eab58c70",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3237.0,
"function_hash": "62802523090567227422997160204342361417"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02160112e6d45c2610b049df6eb693d7a2e57b46",
"id": "CVE-2023-52444-f048f8c1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "f2fs_rename",
"file": "fs/f2fs/namei.c"
},
"digest": {
"length": 3321.0,
"function_hash": "296593862529164183136304735238960991736"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0145860c20be6bae6785c7a2249577674702ac7",
"id": "CVE-2023-52444-f1c67fcd",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02160112e6d45c2610b049df6eb693d7a2e57b46",
"id": "CVE-2023-52444-f3dd3a18",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/f2fs/namei.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"124563995629053079900724130677089421533",
"300306636639598202124166397305782513284",
"120740223042143724537745723509017360560",
"64434446712417450517380689881426807245"
]
},
"signature_type": "Line"
}
]