CVE-2023-54068

Vulnerability

Description

A race condition exists in the Linux kernel's f2fs filesystem when handling compressed file writes. In the function f2fs_write_raw_pages(), a previous commit (7377e853967b) released all page locks to avoid a deadlock, but failed to check whether a page was already under writeback before starting a new writeback. This can lead to set_page_writeback() being called on a page that is already in the writeback state, causing a kernel BUG in folio_end_writeback() at mm/filemap.c:1619` when the page completes writeback and the kernel detects the double writeback [1].

Exploitation

Scenario

The vulnerability can be triggered by concurrent write operations on compressed files. As described in the CVE description, three processes can race: Process A redirties and unlocks a page, Process B starts the first writeback and unlocks the page, and Process C dirties the page again. When Process A re-locks the page and attempts to write it again, it calls set_page_writeback() a second time without waiting for the first writeback to complete. This race requires local access to the filesystem and the ability to perform concurrent writes on compressed files, but no special privileges beyond normal file write permissions [1].

Impact

If successfully exploited, this race condition causes a kernel BUG, resulting in a system crash (denial of service). The kernel panics with a BUG at mm/filemap.c:1619 with the message "kernel BUG at mm/filemap.c:1619!". This can lead to system instability or a complete system hang, requiring a reboot to recover. There is no evidence of privilege escalation or data corruption beyond the immediate crash [1].

Mitigation

The fix is to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() before starting a new writeback, ensuring that any previous writeback on the same page completes first. The patch has been applied to the Linux kernel stable tree in commit 9940877c4fe752923a53f0f7372f2f152b6eccf0 [1]. Users should update their kernel to include this fix or apply the patch if using a custom kernel. No workaround is available other than avoiding concurrent writes to compressed files, which is not practical.