In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on node blkaddr in truncate_node()
syzbot reports a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534
The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Dec 28, 2024 |
| Ubuntu | — | Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-virtualUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.11.0-18-genericUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-genericUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-raspiUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04dUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-awsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-58-genericUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-generic-64k | Feb 20, 2025 | Dec 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub