CVE-2023-52852

What it actually does

Use-after-free in f2fs compressed read path: f2fs_read_multi_pages continues looping after f2fs_decompress_cluster releases the dictionary on a cached page, allowing subsequent access to a freed dic pointer during memcpy.

Why it matters to the business

Kernel crashes, memory corruption, or potential code execution on Linux systems using f2fs with compression; may lead to denial of service or full host compromise in multi-tenant or storage-heavy environments.

How an attack unfolds

Attacker supplies a malicious f2fs filesystem containing compressed files that cause the readahead path to hit a cached page inside f2fs_decompress_cluster; the loop then dereferences the already-freed dictionary, triggering the use-after-free.

How to fix it

Upgrade to a kernel containing commit 8c4504cc0c64862740a6acb301e0cfa59580dbc5 (or the equivalent stable backport). Rebuild and reboot with the patched kernel; verify f2fs compression code no longer continues after dic release.

How to confirm the fix worked

Confirm the running kernel git commit or package version includes 8c4504cc0c64862740a6acb301e0cfa59580dbc5; reproduce the original call trace with a compressed-file workload and confirm the loop now breaks after dic release.

Typical attack path

1. Mount attacker-controlled f2fs image with compression enabled
2. Trigger filemap_fault or readahead on a compressed file
3. f2fs_read_multi_pages calls f2fs_decompress_cluster and releases dic on cached page
4. Loop continues and performs memcpy on freed dic pointer

How to detect it

Inspect kernel logs for oops/panic traces containing f2fs_read_multi_pages, f2fs_decompress_cluster, and __memcpy; correlate with f2fs mount events or readahead on compressed files.

What your security team should do

• Apply the referenced kernel fix to all f2fs-using systems within standard patch windows
• Temporarily disable f2fs compression on high-risk hosts if immediate reboot is not feasible
• Audit environments for f2fs mounts and prioritize servers handling untrusted storage images