From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 467134594D for ; Sat, 28 Dec 2024 09:47:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735379225; cv=none; b=g31m7ahGw6qgHSrubwhmXw14S7jMmSHHFZmjOqvlQmTm0ulrcTo1AqITVj/KZy1t2ng3QAMInIpVUVcm3TIdFIKmcK6ftFpUPlR+cwyzcax5EunI+pqCjfIvNeWh7bmZXIsTsB/BaZzaudsGi2DcjB4KRdgnhU7v5X5W5uKvItg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735379225; c=relaxed/simple; bh=hbMZhrQsnvJdw0p7sxeK1rHMwCNqcxwR6HeOh1Xn+ps=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AXDKmHzLHR5y6ilECO1wm86m31S2lYZOUxcGKhJB0vJkdhWLrTefhQF+9eewm1JldHIGNwni1Ook3U50NdcqT41kOzwqF72Z4fUJLNioBIgzPoTFqPucoe9KrUQK4078heaStsGQuX++6r4J3oGS2Ya4UvxCf+axv8WrnGKfO9U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=L+HgzXOc; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="L+HgzXOc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C11F3C4CECD; Sat, 28 Dec 2024 09:47:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1735379225; bh=hbMZhrQsnvJdw0p7sxeK1rHMwCNqcxwR6HeOh1Xn+ps=; h=From:To:Cc:Subject:Date:Reply-to:From; b=L+HgzXOcyG00tCqkUY/FNP18kzecvFPZhAjzoMR8VgOqYebwQupccnCpioQBqST/h kYxKADUqn2+oBLfRxYXWOxGjFhSs9Q92Z+nqzozh/O3QeOOdBRFr287ztq8W/8Y3fr Y5ou6rLeigHw+YYljQ1IG3ySr+FOCIdPS/EZ6iJI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-56692: f2fs: fix to do sanity check on node blkaddr in truncate_node() Date: Sat, 28 Dec 2024 10:45:44 +0100 Message-ID: <2024122835-CVE-2024-56692-e6ad@gregkh> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3219; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=hbMZhrQsnvJdw0p7sxeK1rHMwCNqcxwR6HeOh1Xn+ps=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn5J/ZLej/Xqviz+wNjWMHBg00xOtkPGecslpW2LD5Zb H7f+IJjRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykT4xhwRQ7ls3LSv0KUlnZ +i0yHyUxbJ6Wz7Dg9FYGjbuVCR7LBI2VH7I777iwiJsdAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node blkaddr in truncate_node() syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node(). The Linux kernel CVE team has assigned CVE-2024-56692 to this issue. Affected and fixed versions =========================== Fixed in 6.6.64 with commit 27d6e7eff07f8cce8e83b162d8f21a07458c860d Fixed in 6.11.11 with commit c1077078ce4589b5e5387f6b0aaa0d4534b9eb57 Fixed in 6.12.2 with commit 0a5c8b3fbf6200f1c66062d307c9a52084917788 Fixed in 6.13-rc1 with commit 6babe00ccd34fc65b78ef8b99754e32b4385f23d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-56692 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/f2fs/node.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/27d6e7eff07f8cce8e83b162d8f21a07458c860d https://git.kernel.org/stable/c/c1077078ce4589b5e5387f6b0aaa0d4534b9eb57 https://git.kernel.org/stable/c/0a5c8b3fbf6200f1c66062d307c9a52084917788 https://git.kernel.org/stable/c/6babe00ccd34fc65b78ef8b99754e32b4385f23d