{
  "threat_severity" : "Moderate",
  "public_date" : "2025-12-09T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: f2fs: fix to do sanity check on direct node in truncate_dnode()",
    "id" : "2420324",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2420324"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nf2fs: fix to do sanity check on direct node in truncate_dnode()\nsyzbot reports below bug:\nBUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\nRead of size 4 at addr ffff88802a25c000 by task syz-executor148/5000\nCPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106\nprint_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351\nprint_report mm/kasan/report.c:462 [inline]\nkasan_report+0x11c/0x130 mm/kasan/report.c:572\nf2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\ntruncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944\nf2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154\nf2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721\nf2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749\nf2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799\nf2fs_truncate include/linux/fs.h:825 [inline]\nf2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006\nnotify_change+0xb2c/0x1180 fs/attr.c:483\ndo_truncate+0x143/0x200 fs/open.c:66\nhandle_truncate fs/namei.c:3295 [inline]\ndo_open fs/namei.c:3640 [inline]\npath_openat+0x2083/0x2750 fs/namei.c:3791\ndo_filp_open+0x1ba/0x410 fs/namei.c:3818\ndo_sys_openat2+0x16d/0x4c0 fs/open.c:1356\ndo_sys_open fs/open.c:1372 [inline]\n__do_sys_creat fs/open.c:1448 [inline]\n__se_sys_creat fs/open.c:1442 [inline]\n__x64_sys_creat+0xcd/0x120 fs/open.c:1442\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nThe root cause is, inodeA references inodeB via inodeB's ino, once inodeA\nis truncated, it calls truncate_dnode() to truncate data blocks in inodeB's\nnode page, it traverse mapping data from node->i.i_addr[0] to\nnode->i.i_addr[ADDRS_PER_BLOCK() - 1], result in out-of-boundary access.\nThis patch fixes to add sanity check on dnode page in truncate_dnode(),\nso that, it can help to avoid triggering such issue, and once it encounters\nsuch issue, it will record newly introduced ERROR_INVALID_NODE_REFERENCE\nerror into superblock, later fsck can detect such issue and try repairing.\nAlso, it removes f2fs_truncate_data_blocks() for cleanup due to the\nfunction has only one caller, and uses f2fs_truncate_data_blocks_range()\ninstead.", "A use-after-free vulnerability was found in the F2FS filesystem in the Linux kernel. The truncate_dnode() function lacks proper sanity checks on direct node pages, allowing a corrupted filesystem where one inode incorrectly references another inode's node to trigger out-of-bounds memory access during truncation operations." ],
  "statement" : "Triggering this flaw requires a maliciously crafted or corrupted F2FS filesystem image. F2FS is primarily used on mobile devices and flash storage, which limits exposure in typical enterprise environments.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53846\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53846\nhttps://lore.kernel.org/linux-cve-announce/2025120959-CVE-2023-53846-70c9@gregkh/T" ],
  "name" : "CVE-2023-53846",
  "csaw" : false
}