CVE-2023-52848

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52848
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52848.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52848
Related
Published
2024-05-21T16:15:21Z
Modified
2024-09-18T03:24:39.744262Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to drop metainode's page cache in f2fsput_super()

syzbot reports a kernel bug as below:

F2FS-fs (loop1): detect filesystem reference count leak during umount, type: 10, count: 1 kernel BUG at fs/f2fs/super.c:1639! CPU: 0 PID: 15451 Comm: syz-executor.1 Not tainted 6.5.0-syzkaller-09338-ge0152e7481c6 #0 RIP: 0010:f2fsputsuper+0xce1/0xed0 fs/f2fs/super.c:1639 Call Trace: genericshutdownsuper+0x161/0x3c0 fs/super.c:693 killblocksuper+0x3b/0x70 fs/super.c:1646 killf2fssuper+0x2b7/0x3d0 fs/f2fs/super.c:4879 deactivatelockedsuper+0x9a/0x170 fs/super.c:481 deactivatesuper+0xde/0x100 fs/super.c:514 cleanupmnt+0x222/0x3d0 fs/namespace.c:1254 taskworkrun+0x14d/0x240 kernel/taskwork.c:179 resumeusermodework include/linux/resumeusermode.h:49 [inline] exittousermodeloop kernel/entry/common.c:171 [inline] exittousermodeprepare+0x210/0x240 kernel/entry/common.c:204 _syscallexittousermodework kernel/entry/common.c:285 [inline] syscallexittousermode+0x1d/0x60 kernel/entry/common.c:296 dosyscall64+0x44/0xb0 arch/x86/entry/common.c:86 entrySYSCALL64afterhwframe+0x63/0xcd

In f2fsputsuper(), it tries to do sanity check on dirty and IO reference count of f2fs, once there is any reference count leak, it will trigger panic.

The root case is, during f2fsputsuper(), if there is any IO error in f2fswaitonallpages(), we missed to truncate meta_inode's page cache later, result in panic, fix this case.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.8-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}