Linux Kernel F2FS Filesystem Compressed Cache Inode Validation Vulnerability

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can lead to improper validation of compressed cache inodes. This issue arises because the F2FS_COMPRESS_INO() function uses a synthetic inode number that only exists when the compress_cache mount option is enabled. When this option is disabled, the synthetic inode number falls outside the valid range, allowing corrupted directory entries to be incorrectly processed. The vulnerability allows F2FS to bypass necessary inode range checks, potentially leading to the instantiation of fake internal inodes.

Impact

Exploitation of this vulnerability can cause F2FS to create fake internal inodes, bypassing essential validation checks and potentially leading to filesystem corruption or other unintended behaviors.

Reproduction

To reproduce this vulnerability, mount an F2FS filesystem with the compress_cache option disabled. Then, create a corrupted directory entry that points to an inode number equal to the maximum inode number (max_nid) for the filesystem. When the filesystem checks the inode number, it should be rejected as out of range, but due to the vulnerability, the check is bypassed and a fake inode is created instead.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.