CVE-2023-52848

What it actually does

During f2fs_put_super(), an IO error in f2fs_wait_on_all_pages() can leave meta_inode page cache intact, causing a filesystem reference count leak that triggers a kernel BUG/panic on unmount.

Why it matters to the business

Systems using the f2fs filesystem may experience unexpected crashes during shutdown or unmount operations under IO error conditions, leading to downtime and potential data inconsistency risks until patched.

How an attack unfolds

An attacker with local access crafts or mounts a malicious f2fs image and triggers specific IO errors during unmount to exploit the missed page cache truncation, resulting in a kernel panic; no remote or unauthenticated exploitation path exists.

How to fix it

Update the Linux kernel to the fixed commit eb42e1862aa7934c2c21890097ce4993c5e0d192 or apply the equivalent stable patch that ensures meta_inode page cache is dropped even after IO errors in f2fs_put_super().

How to confirm the fix worked

Confirm the fix by verifying the presence of the eb42e1862aa7934c2c21890097ce4993c5e0d192 commit in the kernel source and testing unmount under simulated IO error conditions without triggering the reference count panic.

Typical attack path

1. Gain local access to a system with f2fs support
2. Mount a specially crafted f2fs filesystem image
3. Induce IO errors during f2fs_wait_on_all_pages() in put_super path
4. Trigger unmount to cause reference count leak and kernel BUG

How to detect it

Review kernel logs for F2FS-fs reference count leak messages and BUG at fs/f2fs/super.c:1639 during umount operations; correlate with f2fs filesystem activity.

What your security team should do

• Prioritize kernel updates for systems using f2fs filesystems
• Monitor for f2fs unmount-related kernel panics in logs
• Apply the patch from the referenced commit across all affected distributions