CVE-2023-54182

Vulnerability

Description

In the Linux kernel's f2fs (Flash-Friendly File System) implementation, a flaw exists in the mount and remount logic when handling multi-device configurations. The vulnerability arises because the kernel does not correctly verify the read-only status of all secondary devices before allowing a read-write mount or remount operation. Specifically, when a secondary device is set to read-only (read-only) via blockdev --setro, the filesystem can still be mounted as read-write, leading to an inconsistent state [1].

Exploitation

An attacker with local access can exploit this by first creating a multi-device f2fs filesystem where one device is marked read-only. Then, they can mount the filesystem with a read-write option, bypassing the intended protection. A subsequent write operation, such as dd if=/dev/zero of=/mnt/f2fs/file, triggers a kernel BUG at fs/f2fs/inline.c:258 in the f2fs_write_inline_data function, causing a kernel panic [1]. The attack requires the ability to create and mount filesystems, which typically needs root privileges, but the impact is a denial of service (system crash).

Impact

Successful exploitation results in a kernel panic, leading to a denial of service (DoS) for the entire system. The vulnerability does not provide code execution or privilege escalation, but it can be used to crash a system reliably. The issue is present in the Linux kernel's f2fs subsystem and affects systems using multi-device f2fs configurations.

Mitigation

The fix introduces a new helper function f2fs_dev_is_readonly() and modifies f2fs_remount() to check the read-only status of all devices before allowing a remount to read-write. The patch has been applied to the stable kernel tree [1]. Users should update their kernel to a version containing this fix. There is no known workaround other than avoiding multi-device f2fs mounts with mixed read-only/read-write devices.