Linux Kernel F2FS Filesystem Read-Only Condition Handling Vulnerability

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can lead to a system panic. This issue arises when a multi-device image is mounted with read-write options, but one of the secondary devices is set to read-only. The vulnerability occurs because the file system does not correctly check the read-only status of the devices, allowing for an inconsistent mount state. When an attempt is made to write data to the read-only device, it triggers a kernel bug, causing a panic. The issue affects several versions of the Linux kernel.

Impact

Exploiting this vulnerability causes a kernel panic, disrupting system operations and potentially leading to a denial of service.

Reproduction

The vulnerability can be reproduced by creating a multi-device F2FS image using Zram devices. One of the devices should be set to read-only. After mounting the file system, an attempt to remount it as read-write and write data will trigger the kernel panic. This sequence of actions demonstrates the flaw in how the file system handles read-only conditions, leading to a crash.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for updating the kernel can be found in the official Linux documentation.