In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode<\/p>\n
– ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE)\t\t– shrink
\n – f2fs_gc
\n – gc_data_segment
\n – ra_data_block(cow_inode)
\n – mapping = F2FS_I(inode)->atomic_inode->i_mapping
\n : f2fs_is_cow_file(cow_inode) is true
\n\t\t\t\t\t\t – f2fs_evict_inode(atomic_inode)
\n\t\t\t\t\t\t – clear_inode_flag(fi->cow_inode, FI_COW_FILE)
\n\t\t\t\t\t\t – F2FS_I(fi->cow_inode)->atomic_inode = NULL
\n\t\t\t\t\t\t …
\n\t\t\t\t\t\t – truncate_inode_pages_final(atomic_inode)
\n – f2fs_grab_cache_folio(mapping)
\n : create folio in atomic_inode->mapping
\n\t\t\t\t\t\t – clear_inode(atomic_inode)
\n\t\t\t\t\t\t – BUG_ON(atomic_inode->i_data.nrpages)<\/p>\n
We need to add a reference on fi->atomic_inode before using its mapping
\nfield during garbage collection, otherwise, it will cause UAF issue.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode<\/p>\n
– ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE)\t\t– shrink
\n – f2fs_gc
\n – gc_da<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14891","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}