CVE-2023-52852

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix to avoid use-after-free on dic

Call trace: __memcpy+0x128/0x250 f2fs_read_multi_pages+0x940/0xf7c f2fs_mpage_readpages+0x5a8/0x624 f2fs_readahead+0x5c/0x110 page_cache_ra_unbounded+0x1b8/0x590 do_sync_mmap_readahead+0x1dc/0x2e4 filemap_fault+0x254/0xa8c f2fs_filemap_fault+0x2c/0x104 __do_fault+0x7c/0x238 do_handle_mm_fault+0x11bc/0x2d14 do_mem_abort+0x3a8/0x1004 el0_da+0x3c/0xa0 el0t_64_sync_handler+0xc4/0xec el0t_64_sync+0x1b4/0x1b8

In f2fs_read_multi_pages(), once f2fs_decompress_cluster() was called if we hit cached page in compress_inodes cache, dic may be released, it needs break the loop rather than continuing it, in order to avoid accessing invalid dic pointer.

Weakness

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Affected Software

Extended Description

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.

Potential Mitigations

References

• https://git.kernel.org/stable/c/8c4504cc0c64862740a6acb301e0cfa59580dbc5
• https://git.kernel.org/stable/c/932ddb5c29e884cc6fac20417ece72ba4a35c401
• https://git.kernel.org/stable/c/9375ea7f269093d7c884857ae1f47633a91f429c
• https://git.kernel.org/stable/c/9d065aa52b6ee1b06f9c4eca881c9b4425a12ba2
• https://git.kernel.org/stable/c/b0327c84e91a0f4f0abced8cb83ec86a7083f086
• https://git.kernel.org/stable/c/8c4504cc0c64862740a6acb301e0cfa59580dbc5
• https://git.kernel.org/stable/c/932ddb5c29e884cc6fac20417ece72ba4a35c401
• https://git.kernel.org/stable/c/9375ea7f269093d7c884857ae1f47633a91f429c
• https://git.kernel.org/stable/c/9d065aa52b6ee1b06f9c4eca881c9b4425a12ba2
• https://git.kernel.org/stable/c/b0327c84e91a0f4f0abced8cb83ec86a7083f086