{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-52588", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-02T21:55:42.570Z", "datePublished": "2024-03-06T06:45:21.925Z", "dateUpdated": "2026-08-05T09:10:30.257Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:30.257Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\")." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through local f2fs paths (fallocate COLLAPSE/INSERT and F2FS_IOC_MOVE_RANGE → __clone_blkaddrs; write(2) to compressed files → set_cluster_dirty; F2FS_IOC_COMPRESS/DECOMPRESS_FILE → redirty_blocks), not via network or adjacent-link protocol handlers.\nAC:L - An unprivileged attacker can reliably create the inconsistent state by migrating blocks and forcing checkpoint via sync/syncfs/fsync; checkpoint deterministically skips non-gcing data pages (waits only on F2FS_WB_CP_DATA), and SPOR is an expected f2fs recovery condition on Android/embedded deployments rather than an attacker-uncontrollable race.\nPR:L - Triggering requires only ordinary write access to a file on a mounted f2fs volume (fallocate/write/ioctl with FMODE_WRITE); the compress/decompress and fallocate paths have no CAP_SYS_ADMIN check, and owners can enable compression via FS_IOC_SETFLAGS.\nUI:N - On typical f2fs deployments (e.g. Android userdata) the filesystem is already mounted; the attacker triggers migration and checkpointing entirely with their own syscalls, with no separate victim action required.\nS:U - Impact is confined to on-disk f2fs file/metadata integrity within the same kernel security authority; there is no VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:L - After SPOR, node metadata can reference newly allocated blocks that were never written, so reads return prior on-disk contents of those LFS blocks (potentially another user's deleted data), but without active cross-linking of live files this is limited disclosure rather than arbitrary memory read.\nI:H - Out-of-order persistency between migrated data and node pages causes silent, durable corruption or loss of file contents after sudden power-off, matching the fix description and other f2fs CP-persistence integrity bugs.\nA:H - Corrupted migrated/compressed clusters can permanently fail reads (wrong or undecompressible data), surface -EIO/-EFSCORRUPTED, and flag SBI_NEED_FSCK—on Android/embedded f2fs userdata this is a durable availability loss requiring repair or data wipe." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/compress.c", "fs/f2fs/file.c" ], "versions": [ { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7ea0f29d9fd84905051be020c0df7d557e286136", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7c972c89457511007dfc933814c06786905e515c", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/compress.c", "fs/f2fs/file.c" ], "versions": [ { "version": "3.8", "status": "affected" }, { "version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.77", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.16", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.4", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.149" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.77" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.7.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136" }, { "url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c" }, { "url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde" }, { "url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3" }, { "url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b" } ], "title": "f2fs: fix to tag gcing flag on page during block migration", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.145Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-08-15T19:26:08.215846Z", "id": "CVE-2023-52588", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:26:15.622Z" } } ] } }