linux-cve-announce - CVE-2023-53214: f2fs: fix to avoid potential memory corruption in __update_iostat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091511-CVE-2023-53214-87f5@gregkh>
Date: Mon, 15 Sep 2025 16:21:48 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53214: f2fs: fix to avoid potential memory corruption in __update_iostat_latency()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid potential memory corruption in __update_iostat_latency()

Add iotype sanity check to avoid potential memory corruption.
This is to fix the compile error below:

fs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow
'io_lat->peak_lat[type]' 3 <= 3

vim +228 fs/f2fs/iostat.c

  211  static inline void __update_iostat_latency(struct bio_iostat_ctx
	*iostat_ctx,
  212					enum iostat_lat_type type)
  213  {
  214		unsigned long ts_diff;
  215		unsigned int page_type = iostat_ctx->type;
  216		struct f2fs_sb_info *sbi = iostat_ctx->sbi;
  217		struct iostat_lat_info *io_lat = sbi->iostat_io_lat;
  218		unsigned long flags;
  219
  220		if (!sbi->iostat_enable)
  221			return;
  222
  223		ts_diff = jiffies - iostat_ctx->submit_ts;
  224		if (page_type >= META_FLUSH)
                                 ^^^^^^^^^^

  225			page_type = META;
  226
  227		spin_lock_irqsave(&sbi->iostat_lat_lock, flags);
 @228		io_lat->sum_lat[type][page_type] += ts_diff;
                                      ^^^^^^^^^
Mixup between META_FLUSH and NR_PAGE_TYPE leads to memory corruption.

The Linux kernel CVE team has assigned CVE-2023-53214 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit a4b6817625e71d5d4aee16cacf7a7fec077c6dbe and fixed in 5.15.100 with commit aa4d726af72a21732ce120484e0b1240674a13b3
	Issue introduced in 5.15 with commit a4b6817625e71d5d4aee16cacf7a7fec077c6dbe and fixed in 6.1.18 with commit 22ddbbff116ee7dce5431feb1c0f36a507d2d68d
	Issue introduced in 5.15 with commit a4b6817625e71d5d4aee16cacf7a7fec077c6dbe and fixed in 6.2.5 with commit 20b4f3de0f3932f71b4a8daf0671e517a8d98022
	Issue introduced in 5.15 with commit a4b6817625e71d5d4aee16cacf7a7fec077c6dbe and fixed in 6.3 with commit 0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53214
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/iostat.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/aa4d726af72a21732ce120484e0b1240674a13b3
	https://git.kernel.org/stable/c/22ddbbff116ee7dce5431feb1c0f36a507d2d68d
	https://git.kernel.org/stable/c/20b4f3de0f3932f71b4a8daf0671e517a8d98022
	https://git.kernel.org/stable/c/0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592