CVE-2023-54124

Vulnerability

Description

In the Linux kernel's f2fs filesystem, a bug was found where during unmount (umount) if the checkpoint error (cp_error) flag is set, the function f2fs_wait_on_all_pages() does not correctly handle all F2FS_WB_CP_DATA pages. This leads to a kernel BUG at f2fs_put_super because the `fsync_node_num remains non-zero after waiting for page writeback, as reported by xfstest generic/361 [1][2].

Exploitation

An attacker with local access and the ability to trigger a checkpoint error on an f2fs filesystem (e.g., through a storage device failure or by corrupting the filesystem metadata) can cause the system to panic during unmount. No special privileges beyond the ability to mount and unmount the filesystem are required, but the attack surface is limited to scenarios where the filesystem is in an error state.

Impact

Successful exploitation results in a kernel panic (BUG_ON), leading to a denial of service (system crash) when the filesystem is unmounted. This can disrupt system availability and potentially cause data loss if the filesystem is not cleanly unmounted.

ounted.

Mitigation

The fix, committed in the Linux kernel stable tree, ensures that when cp_error is set, all dirty pages are dropped instead of being redirtied, preventing the deadloop and the subsequent BUG. Users should apply the kernel patch referenced in the commit IDs [1][2] to resolve the issue.