{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-54182","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-30T12:06:44.497Z","datePublished":"2025-12-30T12:08:53.092Z","dateUpdated":"2026-08-05T09:17:51.173Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:17:51.173Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet's introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n  f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n  f2fs_write_data_pages+0x2e/0x40 [f2fs]\n  do_writepages+0xd3/0x1b0\n  __writeback_single_inode+0x5b/0x420\n  writeback_sb_inodes+0x236/0x5a0\n  __writeback_inodes_wb+0x56/0xf0\n  wb_writeback+0x2a3/0x490\n  wb_do_writeback+0x2b2/0x330\n  wb_workfn+0x6a/0x260\n  process_one_work+0x270/0x5e0\n  worker_thread+0x52/0x3e0\n  kthread+0xf4/0x120\n  ret_from_fork+0x29/0x50"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through local filesystem operations — a mount/remount syscall on a local block device followed by ordinary file writes on the mounted f2fs volume. There is no network-facing component in fs/f2fs/super.c or the writeback path.\nAC:L - Once a multi-device f2fs volume with a read-only secondary device has been remounted read-write, writing any file larger than MAX_INLINE_DATA deterministically drives f2fs_write_inline_data() into f2fs_bug_on(sbi, page->index) with 100% reliability. There is no race to win and no memory layout to groom.\nPR:L - The final trigger requires only an unprivileged local user with write access to the mounted filesystem — the inconsistent RW state is created by the kernel wrongly accepting a remount that mount(8) itself flagged as write-protected, which an admin will naturally attempt after seeing the \"source write-protected, mounted read-only\" warning. No capability is needed to issue the writes that panic the kernel.\nUI:N - No victim action is needed at exploitation time; the attacker simply writes to a file and the writeback kworker hits the BUG asynchronously. The vulnerable mount state is a pre-existing system condition, not an interaction the attacker must induce.\nS:U - The impact is confined to the kernel and the affected filesystem within the same security authority — there is no VM, sandbox, or IOMMU boundary crossed.\nC:N - All data movement in the affected paths (f2fs_do_read_inline_data, f2fs_truncate_inline_inode, f2fs_write_inline_data) is bounded by MAX_INLINE_DATA(inode) inside the inode's own node page, so there is no out-of-bounds read, no uninitialized memory exposure, and no cross-file disclosure.\nI:H - The inconsistent mount lets f2fs_convert_inline_inode() silently skip conversion, so an inode retains FI_INLINE_DATA while holding data blocks past index 0; the WARN path then memcpy's the wrong page into the inline data area and writes to the read-only member device are rejected by bio_check_ro(), producing on-disk data and metadata corruption, checkpoint errors, and a filesystem flagged SBI_NEED_FSCK.\nA:H - With CONFIG_F2FS_CHECK_FS the assertion is a hard BUG_ON that panics the kernel from the writeback kworker (the exact \"kernel BUG at fs/f2fs/inline.c:258\" reported in the fix). Even without it, the resulting I/O failures on the read-only device drive the filesystem into a checkpoint-error state, taking the volume offline."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"],"versions":[{"version":"f824deb54b683165b953371a0529446c723ef6d6","lessThan":"e2759a59a4cc96af712084e9db7065c858c4fe9f","status":"affected","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","lessThan":"e05d63f8b48aad4613bd582c945bee41e2dd7255","status":"affected","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","lessThan":"da8c535b28696017e5d1532d12ea78e836432d9e","status":"affected","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","lessThan":"d78dfefcde9d311284434560d69c0478c55a657e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"],"versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","status":"unaffected","versionType":"semver"},{"version":"5.15.113","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.30","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.3.4","lessThanOrEqual":"6.3.*","status":"unaffected","versionType":"semver"},{"version":"6.4","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.15.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.1.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.3.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f"},{"url":"https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255"},{"url":"https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e"},{"url":"https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"}],"title":"f2fs: fix to check readonly condition correctly","x_generator":{"engine":"bippy-1.2.0"}}}}