{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54182", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.497Z", "datePublished": "2025-12-30T12:08:53.092Z", "dateUpdated": "2026-08-05T09:17:51.173Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:51.173Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet's introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n f2fs_write_data_pages+0x2e/0x40 [f2fs]\n do_writepages+0xd3/0x1b0\n __writeback_single_inode+0x5b/0x420\n writeback_sb_inodes+0x236/0x5a0\n __writeback_inodes_wb+0x56/0xf0\n wb_writeback+0x2a3/0x490\n wb_do_writeback+0x2b2/0x330\n wb_workfn+0x6a/0x260\n process_one_work+0x270/0x5e0\n worker_thread+0x52/0x3e0\n kthread+0xf4/0x120\n ret_from_fork+0x29/0x50" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through local filesystem operations — a mount/remount syscall on a local block device followed by ordinary file writes on the mounted f2fs volume. There is no network-facing component in fs/f2fs/super.c or the writeback path.\nAC:L - Once a multi-device f2fs volume with a read-only secondary device has been remounted read-write, writing any file larger than MAX_INLINE_DATA deterministically drives f2fs_write_inline_data() into f2fs_bug_on(sbi, page->index) with 100% reliability. There is no race to win and no memory layout to groom.\nPR:L - The final trigger requires only an unprivileged local user with write access to the mounted filesystem — the inconsistent RW state is created by the kernel wrongly accepting a remount that mount(8) itself flagged as write-protected, which an admin will naturally attempt after seeing the \"source write-protected, mounted read-only\" warning. No capability is needed to issue the writes that panic the kernel.\nUI:N - No victim action is needed at exploitation time; the attacker simply writes to a file and the writeback kworker hits the BUG asynchronously. The vulnerable mount state is a pre-existing system condition, not an interaction the attacker must induce.\nS:U - The impact is confined to the kernel and the affected filesystem within the same security authority — there is no VM, sandbox, or IOMMU boundary crossed.\nC:N - All data movement in the affected paths (f2fs_do_read_inline_data, f2fs_truncate_inline_inode, f2fs_write_inline_data) is bounded by MAX_INLINE_DATA(inode) inside the inode's own node page, so there is no out-of-bounds read, no uninitialized memory exposure, and no cross-file disclosure.\nI:H - The inconsistent mount lets f2fs_convert_inline_inode() silently skip conversion, so an inode retains FI_INLINE_DATA while holding data blocks past index 0; the WARN path then memcpy's the wrong page into the inline data area and writes to the read-only member device are rejected by bio_check_ro(), producing on-disk data and metadata corruption, checkpoint errors, and a filesystem flagged SBI_NEED_FSCK.\nA:H - With CONFIG_F2FS_CHECK_FS the assertion is a hard BUG_ON that panics the kernel from the writeback kworker (the exact \"kernel BUG at fs/f2fs/inline.c:258\" reported in the fix). Even without it, the resulting I/O failures on the read-only device drive the filesystem into a checkpoint-error state, taking the volume offline." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/super.c" ], "versions": [ { "version": "f824deb54b683165b953371a0529446c723ef6d6", "lessThan": "e2759a59a4cc96af712084e9db7065c858c4fe9f", "status": "affected", "versionType": "git" }, { "version": "f824deb54b683165b953371a0529446c723ef6d6", "lessThan": "e05d63f8b48aad4613bd582c945bee41e2dd7255", "status": "affected", "versionType": "git" }, { "version": "f824deb54b683165b953371a0529446c723ef6d6", "lessThan": "da8c535b28696017e5d1532d12ea78e836432d9e", "status": "affected", "versionType": "git" }, { "version": "f824deb54b683165b953371a0529446c723ef6d6", "lessThan": "d78dfefcde9d311284434560d69c0478c55a657e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/f2fs.h", "fs/f2fs/super.c" ], "versions": [ { "version": "5.2", "status": "affected" }, { "version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.113", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f" }, { "url": "https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255" }, { "url": "https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e" }, { "url": "https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e" } ], "title": "f2fs: fix to check readonly condition correctly", "x_generator": { "engine": "bippy-1.2.0" } } } }