In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: don't allow unaligned truncation on released compress inode
f2fs image may be corrupted after below testcase: - mkfs.f2fs -O extraattr,compression -f /dev/vdb - mount /dev/vdb /mnt/f2fs - touch /mnt/f2fs/file - f2fsio setflags compression /mnt/f2fs/file - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4 - f2fsio releasecblocks /mnt/f2fs/file - truncate -s 8192 /mnt/f2fs/file - umount /mnt/f2fs - fsck.f2fs /dev/vdb
[ASSERT] (fsckchkinodeblk:1256) --> ino: 0x5 has iblocks: 0x00000002, but has 0x3 blocks [FSCK] validblockcount matching with CP [Fail] [0x4, 0x5] [FSCK] other corrupted bugs [Fail]
The reason is: partial truncation assume compressed inode has reserved blocks, after partial truncation, valid block count may change w/o .iblocks and .totalvalidblockcount update, result in corruption.
This patch only allow cluster size aligned truncation on released compress inode for fixing.
[
{
"id": "CVE-2024-33847-050d1079",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"247013922393219344897150709959260696421",
"283092339787707399426578628492822186095",
"41461735861995314404151317304409575012"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee"
},
{
"id": "CVE-2024-33847-067aa691",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "321711522075223364265950475733391564621",
"length": 2131.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5268241b41b1c5d0acca75e9b97d4fd719251c8c"
},
{
"id": "CVE-2024-33847-4a03411a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "66549102003631826370700315178800048299",
"length": 2280.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8962cf98595d1ec62f40f23667de830567ec8bc"
},
{
"id": "CVE-2024-33847-75d6f6c4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"102710362300931544636331353188332902483",
"50213777957157354459878397953093692518",
"158450540933828470799286697940574601225"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8962cf98595d1ec62f40f23667de830567ec8bc"
},
{
"id": "CVE-2024-33847-81934deb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "178225201504882779692570821222430350211",
"length": 2144.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ccf5210dc941a7aa0180596ac021568be4d35ec"
},
{
"id": "CVE-2024-33847-8388f1ef",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"247013922393219344897150709959260696421",
"283092339787707399426578628492822186095",
"41461735861995314404151317304409575012"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5268241b41b1c5d0acca75e9b97d4fd719251c8c"
},
{
"id": "CVE-2024-33847-85242798",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "321711522075223364265950475733391564621",
"length": 2131.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee"
},
{
"id": "CVE-2024-33847-91b8a232",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"198910341777290675102726796980794091613",
"262449594812136064820821361360880329316",
"241564304712330364296284440408191658102"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8acae047215024d1ac499b3c8337ef1b952f160b"
},
{
"id": "CVE-2024-33847-a27bde99",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "203753404505056682914004449105580584384",
"length": 2321.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8acae047215024d1ac499b3c8337ef1b952f160b"
},
{
"id": "CVE-2024-33847-cb377d82",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_setattr"
},
"digest": {
"function_hash": "249290042502196944264188730546902270371",
"length": 2129.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d"
},
{
"id": "CVE-2024-33847-e66c683d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"247013922393219344897150709959260696421",
"283092339787707399426578628492822186095",
"41461735861995314404151317304409575012"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d"
},
{
"id": "CVE-2024-33847-f9c9c7a1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/file.c"
},
"digest": {
"line_hashes": [
"203923692018831601440220892969926358990",
"80546737847895605324607309208162560776",
"276793108110433043535688525633198027591",
"79696238384581272694678908832333667611",
"114618962492781572139355856896361335475",
"326384184303962128667016259738843351246"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ccf5210dc941a7aa0180596ac021568be4d35ec"
}
]