CVE-2023-53537
Description
A use-after-free flaw was found in the Linux kernel's F2FS filesystem in the cached IPU (In-Place Update) bio handling. A local user can trigger this issue when checkpoint errors occur during writeback, causing f2fs_submit_merged_ipu_write to submit a stale cached bio pointer that belongs to a different IO context. This results in using freed memory, triggering kernel bugs in page writeback completion, and causing denial of service through kernel crashes.
Statement
F2FS uses IPU to update data blocks in-place rather than through log-structured writes. When a checkpoint error is set, the f2fs_write_single_data_page function calls f2fs_submit_merged_ipu_write to flush any pending IPU writes. However, this function fails to validate the bio parameter before submission. If the cached bio pointer is stale or belongs to another IO context, submitting it causes use-after-free when the bio completion handler tries to end page writeback on pages that may have already been freed or belong to other operations. The issue manifests as "Bad page map" warnings and kernel BUGs in folio_end_writeback. Triggering requires F2FS filesystems under conditions that set cp_error, such as during error recovery or stress testing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 7.8 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | None | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
