In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix general protection fault in nilfsbtreeinsert()
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling _nilfsbtreegetblock() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave.
When nilfsbtreeinsert() receives this spurious 'not found' code from nilfsbtreedo_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash:
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfsbtreegetnonrootnode fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfsbtreeprepareinsert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfsbtreeinsert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfsbmapdoinsert fs/nilfs2/bmap.c:121 [inline] nilfsbmapinsert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfsgetblock+0x414/0x8d0 fs/nilfs2/inode.c:101 _blockwritebeginint+0x54c/0x1a80 fs/buffer.c:1991 _blockwritebegin fs/buffer.c:2041 [inline] blockwritebegin+0x93/0x1e0 fs/buffer.c:2102 nilfswritebegin+0x9c/0x110 fs/nilfs2/inode.c:261 genericperformwrite+0x2e4/0x5e0 mm/filemap.c:3772 _genericfilewriteiter+0x176/0x400 mm/filemap.c:3900 genericfilewriteiter+0xab/0x310 mm/filemap.c:3932 callwriteiter include/linux/fs.h:2186 [inline] newsyncwrite fs/readwrite.c:491 [inline] vfswrite+0x7dc/0xc50 fs/readwrite.c:584 ksyswrite+0x177/0x2a0 fs/readwrite.c:637 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd ... </TASK>
This patch fixes the root cause of this problem by replacing the error code that _nilfsbtreegetblock() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted.
By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfsbmapconvert_error(), and code -EIO will be eventually returned as it should be.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52900.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52900.json"
[
{
"id": "CVE-2023-52900-04206914",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c2a2ff67d46106715c2132021b98bd057c27545",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "282713357758360599599736722619016813793",
"length": 1214.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-0805ed23",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@712bd74eccb9d3626a0a236641962eca8e11a243",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "319851826491214184546748622622013634158",
"length": 1203.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-2cefc58c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c2a2ff67d46106715c2132021b98bd057c27545",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283261716834529129465298454215740106918",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-34eecff5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf463939c09e5b2c35c71ed74a5fd60a74d6a04",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "191565690546477159638854099634093850743",
"length": 1199.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-589b0b51",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7633355e5c7f29c049a9048e461427d1d8ed3051",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28653097009404235334508253699077278280",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-5c085154",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45627a1a6450662e1e0f8174ef07b05710a20062",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "319851826491214184546748622622013634158",
"length": 1203.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-78d826fd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9fde9eab1766170ff2ade67d09178d2cfd78749",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "282713357758360599599736722619016813793",
"length": 1214.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-882612d2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9fde9eab1766170ff2ade67d09178d2cfd78749",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283261716834529129465298454215740106918",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-92bd7aae",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf463939c09e5b2c35c71ed74a5fd60a74d6a04",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"28653097009404235334508253699077278280",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-a2bc491b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@712bd74eccb9d3626a0a236641962eca8e11a243",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283261716834529129465298454215740106918",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-a3dfe2c9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45627a1a6450662e1e0f8174ef07b05710a20062",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283261716834529129465298454215740106918",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-d06f41ee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0ba060d3287108eba17603bee3810e4cf2c272d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283261716834529129465298454215740106918",
"318529695178792784062256258271876914147",
"182761670754581224620293530297056420922",
"259446432019698909500024365379174351056",
"172516370610040929451992080046027330899",
"323489974154360419626867133126073010351"
]
},
"target": {
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-e01ec57e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7633355e5c7f29c049a9048e461427d1d8ed3051",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "191565690546477159638854099634093850743",
"length": 1199.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
},
{
"id": "CVE-2023-52900-f1ccf2f7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0ba060d3287108eba17603bee3810e4cf2c272d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "282713357758360599599736722619016813793",
"length": 1214.0
},
"target": {
"function": "__nilfs_btree_get_block",
"file": "fs/nilfs2/btree.c"
}
}
]