Linux Kernel F2FS Uninitialized Use-After-Free Vulnerability in Garbage Collection

A use-after-free vulnerability has been identified in the Linux kernel's F2FS (Flash-Friendly File System) implementation. This issue arises in the atomic write handling of F2FS inodes, specifically when the garbage collection process is performed on copy-on-write (COW) files. During this process, the kernel fails to properly manage references to inodes, leading to the potential for accessing freed memory. The vulnerability is triggered when the F2FS garbage collector processes COW files without maintaining a valid reference to the atomic inode, allowing for memory corruption.

Impact

Exploitation of this vulnerability can lead to memory corruption, potentially allowing for arbitrary code execution or causing a system crash.

Reproduction

To reproduce this vulnerability, create a file in a F2FS filesystem and mark it as a copy-on-write (COW) file. Then, invoke the F2FS garbage collection process while the COW file is being accessed. The garbage collector will attempt to read data blocks from the COW file, but without a proper reference to the atomic inode, it will clear the inode's mapping before all data has been safely processed. This mishandling creates a use-after-free condition, where the garbage collector accesses memory that has already been freed, leading to undefined behavior.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.