Linux Kernel F2FS Filesystem Sanity Check Vulnerability Leading to Kernel Panic

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation can cause a kernel panic. This issue arises from a lack of proper sanity checks in the 'f2fs_get_node_folio_ra' function, which can lead to corrupted inode handling. When a direct node in the inode has the same inode number and node ID in its footer, it creates a conflict. The 'f2fs_do_truncate_blocks' function then encounters an invalid state, triggering a kernel bug and a system crash. This vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability causes a kernel panic, leading to a system crash.

Reproduction

The vulnerability can be reproduced by using a fuzzing tool, such as Syzkaller, which can trigger the bug by creating a corrupted inode scenario. This involves manipulating the inode data to include a direct node with matching inode and node IDs, causing the 'f2fs_do_truncate_blocks' function to attempt to process it incorrectly. The resulting state violation activates the kernel's bug-on mechanism, causing a crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.