CVE-2021-44879

What it actually does

NULL pointer dereference in gc_data_segment of fs/f2fs/gc.c when special files are encountered during garbage collection, causing move_data_page to crash the kernel.

Why it matters to the business

Denial of service through kernel panics on systems using the F2FS filesystem, resulting in unplanned downtime and potential data loss during recovery; the issue has been public for years with exploits available but no widespread ransomware use.

How an attack unfolds

An attacker with local access crafts or manipulates an F2FS volume containing special files, triggers garbage collection routines, and forces the kernel into the unhandled code path that dereferences a null pointer in move_data_page.

How to fix it

Upgrade the Linux kernel to version 5.16.3 or later; apply commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f in fs/f2fs/gc.c to ensure special files are properly considered before calling move_data_page.

How to confirm the fix worked

Verify the running kernel is at least 5.16.3 or contains commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f; attempt to reproduce the crash scenario on a test F2FS volume with special files and confirm absence of the NULL dereference.

Typical attack path

1. Obtain local user access on a Linux system using F2FS
2. Create or mount an F2FS filesystem containing special device or socket files
3. Perform filesystem operations that invoke garbage collection in gc_data_segment
4. Trigger the missing special-file check leading to NULL dereference in move_data_page

How to detect it

Search kernel logs and crash dumps for oops traces containing gc_data_segment, move_data_page, and f2fs; correlate with recent F2FS mount or file-creation events on affected systems.

• gc_data_segment
• move_data_page
• f2fs/gc.c
• NULL pointer dereference in f2fs

What your security team should do

• Prioritize patching any systems still running kernels before 5.16.3 that use F2FS
• Monitor kernel logs for oops/panic messages referencing f2fs gc_data_segment or move_data_page
• Restrict unprivileged local access on high-value F2FS hosts until patched
• Include F2FS-related kernel crash signatures in existing detection rules given public exploit availability