f2fs: fix to do sanity check on node blkaddr in truncate_node()
Impact
A vulnerability in the Linux kernel's f2fs file system may cause a system panic when a corrupted nat entry is used in f2fs_invalidate_blocks(). The issue is fixed by adding a sanity check on nat blkaddr in truncate_node().
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Linux
5 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 → before a6d51de6bf729edc9fc7f87ffaae4e6bbda6329a
git versions
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 → before 27d6e7eff07f8cce8e83b162d8f21a07458c860d
git versions
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 → before c1077078ce4589b5e5387f6b0aaa0d4534b9eb57
git versions
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 → before 0a5c8b3fbf6200f1c66062d307c9a52084917788
git versions
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 → before 6babe00ccd34fc65b78ef8b99754e32b4385f23d
git versions
Other versions: unaffected
Linux · Linux
Linux
7 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
3.8
unaffected
0 → before 3.8
semver versions
6.1.191 → through 6.1.*
semver versions
6.6.64 → through 6.6.*
semver versions
6.11.11 → through 6.11.*
semver versions
6.12.2 → through 6.12.*
semver versions
6.13 → through *
original_commit_for_fix versions
Other versions: affected
Original source description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on node blkaddr in truncate_node()
syzbot reports a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534
The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node().
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2024-56692View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
Linux · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.8
Before: 6.1.191
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.8
Before: 6.6.64
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.8
Before: 6.11.11
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.8
Before: 6.12.2
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.8
Before: 6.13
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8",
"versionEndExcluding": "6.1.191"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8",
"versionEndExcluding": "6.6.64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8",
"versionEndExcluding": "6.11.11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8",
"versionEndExcluding": "6.12.2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8",
"versionEndExcluding": "6.13"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.