In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on curseg->alloc_type
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215657
- Overview UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image
- Reproduce tested on kernel 5.17-rc4, 5.17-rc6
1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2
- Kernel dump [ 46.434454] loop0: detected capacity change from 0 to 131072 [ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9 [ 46.738319] ================================================================================ [ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 [ 46.738475] index 231 is out of range for type 'unsigned int [2]' [ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 [ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call Trace: [ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [ 46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [ 46.738819] do_write_page+0xef/0x210 [f2fs] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [ 46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [ 46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] [ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [ 46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [ 46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [ 46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is we missed to do sanity check on curseg->alloc_type, result in out-of-bound accessing on sbi->block_count[] array, fix it.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-ibm-5.4Upgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1165-aws-fipsUpgrade linux-image-gcp-5.4Upgrade linux-image-kvmUpgrade linux-image-generic-5.4Upgrade linux-image-5.4.0-1069-iotUpgrade linux-image-5.4.0-1163-oracleUpgrade linux-image-aws-5.4Upgrade linux-image-5.4.0-1170-azure-fipsUpgrade linux-image-gcp-fips-5.4Upgrade linux-image-lowlatencyUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1152-kvmUpgrade linux-image-oracle-5.4Upgrade linux-image-raspi-5.4Upgrade linux-image-awsUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-242-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-gcp-fipsUpgrade linux-image-virtual-5.4Upgrade linux-image-ibmUpgrade linux-image-azure-5.4Upgrade linux-image-5.4.0-1168-gcpUpgrade linux-image-snapdragon-5.4Upgrade linux-image-5.4.0-242-genericUpgrade linux-image-azure-fipsUpgrade linux-image-aws-fips-5.4Upgrade linux-image-fips-5.4Upgrade linux-image-generic-lpaeUpgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-5.4.0-1139-fipsUpgrade linux-image-gcpUpgrade linux-image-generic-lpae-5.4Upgrade linux-image-5.4.0-242-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-azure-fips-5.4Upgrade linux-image-aws-fipsUpgrade linux-image-5.4.0-1170-azureUpgrade linux-image-oemUpgrade linux-image-5.4.0-1165-awsUpgrade linux-image-5.4.0-1111-ibmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1083-xilinx-zynqmpUpgrade linux-image-5.4.0-1148-raspiUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1168-gcp-fipsUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-oracleUpgrade linux-image-lowlatency-5.4Upgrade linux-image-kvm-5.4 | Mar 19, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub