Linux Kernel F2FS Orphan Inode Entry Count Validation Vulnerability

A vulnerability exists in the Linux kernel's handling of orphan inodes in the F2FS file system. The issue arises because the orphan recovery process trusts the entry count from the orphan block when replaying inodes from the checkpoint pack. If the entry count is corrupted and exceeds the maximum allowed, the recovery loop can read past the intended data array, misinterpreting subsequent data as inode numbers. This flaw can lead to a kernel panic. The vulnerability is present in the F2FS file system within the Linux kernel.

Impact

Exploitation of this vulnerability can cause a kernel panic, disrupting system operations and potentially leading to a denial of service.

Reproduction

To reproduce this vulnerability, create a crafted image that includes a corrupted orphan block entry count exceeding the allowed limit. Mount this image on an unpatched Linux kernel version that supports the F2FS file system. During the mounting process, the kernel will attempt to recover orphan inodes. The corrupted entry count will cause the recovery function to read past the end of the inode array, leading to a kernel panic.

Remediation

Users can upgrade to the latest patched version of the Linux kernel, where this vulnerability has been addressed. Instructions for downloading the updated kernel can be found on the official Linux kernel website.