CVE-2025-38677
published 2025-08-30CVE-2025-38677: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported…
high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid out-of-boundary access in dnode page
As Jiaming Zhang reported:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x17e/0x800 mm/kasan/report.c:480
kasan_report+0x147/0x180 mm/kasan/report.c:593
data_blkaddr fs/f2fs/f2fs.h:3053 [inline]
f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline]
f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855
f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195
prepare_write_begin fs/f2fs/data.c:3395 [inline]
f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594
generic_perform_write+0x2c7/0x910 mm/filemap.c:4112
f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline]
f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x546/0xa90 fs/read_write.c:686
ksys_write+0x149/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The root cause is in the corrupted image, there is a dnode has the same
node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to
access block address in dnode at offset 934, however it parses the dnode
as inode node, so that get_dnode_addr() returns 360, then it tries to
access page address from 360 + 934 * 4 = 4096 w/ 4 bytes.
To fix this issue, let's add sanity check for node id of all direct nodes
during f2fs_get_dnode_of_data().
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < ee4d13f5407cbdf1216cc258f45492075713889a | ee4d13f5407cbdf1216cc258f45492075713889a |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < a650654365c57407413e9b1f6ff4d539bf2e99ca | a650654365c57407413e9b1f6ff4d539bf2e99ca |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 6b7784ea07e6aa044f74b39d6b5af5e28746fc81 | 6b7784ea07e6aa044f74b39d6b5af5e28746fc81 |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 901f62efd6e855f93d8b1175540f29f4dc45ba55 | 901f62efd6e855f93d8b1175540f29f4dc45ba55 |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 92ef491b506a0f4dd971a3a76f86f2d8f5370180 | 92ef491b506a0f4dd971a3a76f86f2d8f5370180 |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 888aa660144bcb6ec07839da756ee46bfcf7fc53 | 888aa660144bcb6ec07839da756ee46bfcf7fc53 |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < f1d5093d9fe9f3c74c123741c88666cc853b79c5 | f1d5093d9fe9f3c74c123741c88666cc853b79c5 |
| linux | linux | >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 77de19b6867f2740cdcb6c9c7e50d522b47847a4 | 77de19b6867f2740cdcb6c9c7e50d522b47847a4 |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.48-1 | 6.12.48-1 |
| linux | linux_kernel | >= 0 < 6.16.5-1 | 6.16.5-1 |
| linux | linux_kernel | >= 0 < 5.15.0-163.173 | 5.15.0-163.173 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 3.8 < 5.4.297 | 5.4.297 |
| linux | linux_kernel | >= 5.11 < 5.15.190 | 5.15.190 |
| linux | linux_kernel | >= 5.16 < 6.1.149 | 6.1.149 |
| linux | linux_kernel | >= 5.5 < 5.10.241 | 5.10.241 |
| linux | linux_kernel | >= 6.13 < 6.16.4 | 6.16.4 |
| linux | linux_kernel | >= 6.2 < 6.6.103 | 6.6.103 |
| linux | linux_kernel | >= 6.7 < 6.12.44 | 6.12.44 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH