CVE-2024-53221

What it actually does

Null pointer dereference in f2fs_submit_page_bio() triggered by concurrent f2fs.ko module installation and filesystem mount because biset is not initialized before f2fs_fs_type registration.

Why it matters to the business

Local denial of service via kernel crash on systems mounting f2fs filesystems during module load, potentially disrupting storage operations and requiring reboots.

How an attack unfolds

An attacker with local privileges times the loading of the f2fs module concurrently with a mount operation on an f2fs filesystem to hit the uninitialized biset path during checkpoint validation and bio allocation.

How to fix it

Upgrade the Linux kernel to a version that registers f2fs_fs_type last in init_f2fs_fs() after all resources are initialized. Rebuild and reboot after applying the fix.

How to confirm the fix worked

Confirm the kernel source contains the registration reorder in init_f2fs_fs(), rebuild, and test concurrent module load plus mount without triggering KASAN null-ptr-deref.

Typical attack path

1. Obtain local access to the target system
2. Trigger concurrent f2fs.ko module insertion
3. Issue mount command for f2fs filesystem
4. Reach uninitialized biset in f2fs_fill_super path causing null dereference

How to detect it

Review kernel logs for KASAN null-ptr-deref reports referencing f2fs_submit_page_bio, __bio_alloc, and f2fs_fill_super during module load and mount events.

• KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
• RIP: __bio_alloc+0x2fb/0x6c0 [f2fs]
• Call Trace: f2fs_submit_page_bio+0x126/0x8b0 [f2fs]

What your security team should do

• Prioritize kernel updates on all systems using f2fs
• Restrict local unprivileged module loading via kernel parameters until patched
• Monitor for f2fs mount attempts during module installation windows