CVE-2023-52748

What it actually does

Potential buffer overflow in fs/f2fs/compress.c during slab_name construction via sprintf in f2fs_init_page_array_cache, where a 32-byte buffer receives up to 35 bytes from the format string "f2fs_page_array_entry-%u:%u" expanded with MAJOR/MINOR device numbers.

Why it matters to the business

Kernel builds fail under W=1 with format-overflow warnings treated as errors; unaddressed, this risks slab cache naming issues on f2fs compressed filesystems, potentially causing instability or crashes on affected Linux systems.

How an attack unfolds

An attacker would need to trigger f2fs compression initialization on a device whose major/minor numbers produce a long enough string to overflow the fixed-size slab_name buffer, leading to memory corruption during module load or filesystem mount; no public exploitation or threat actor activity is known.

How to fix it

Update the Linux kernel to the fixed commit c041f5ddef00c731c541e00bc8ae97b8c84c682f or later stable releases that increase slab_name size to 35 bytes; rebuild and redeploy the kernel image.

How to confirm the fix worked

Compile the kernel with gcc -Werror=format-overflow and confirm the warning is absent in fs/f2fs/compress.c:1984; verify slab_name declaration accommodates 35 bytes and test f2fs mount with compression.

Typical attack path

1. Identify or prepare a system using f2fs with compression enabled
2. Trigger f2fs_init_page_array_cache during filesystem initialization or module load
3. Supply device numbers that expand the sprintf format string beyond 32 bytes
4. Cause out-of-bounds write into adjacent kernel memory structures

How to detect it

No runtime exploitation artifacts exist; inspect kernel build logs for the original format-overflow warning and review f2fs module initialization traces for slab allocation failures.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit in all f2fs-using environments
• Enable format-overflow warnings in CI build pipelines to catch similar issues early
• Monitor for any downstream dependent packages requiring rebuild after kernel update