{"id":"CVE-2023-53214","state":"PUBLISHED","title":"f2fs: fix to avoid potential memory corruption in __update_iostat_latency()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential memory corruption in __update_iostat_latency()\n\nAdd iotype sanity check to avoid potential memory corruption.\nThis is to fix the compile error below:\n\nfs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow\n'io_lat->peak_lat[type]' 3 <= 3\n\nvim +228 fs/f2fs/iostat.c\n\n  211  static inline void __update_iostat_latency(struct bio_iostat_ctx\n\t*iostat_ctx,\n  212\t\t\t\t\tenum iostat_lat_type type)\n  213  {\n  214\t\tunsigned long ts_diff;\n  215\t\tunsigned int page_type = iostat_ctx->type;\n  216\t\tstruct f2fs_sb_info *sbi = iostat_ctx->sbi;\n  217\t\tstruct iostat_lat_info *io_lat = sbi->iostat_io_lat;\n  218\t\tunsigned long flags;\n  219\n  220\t\tif (!sbi->iostat_enable)\n  221\t\t\treturn;\n  222\n  223\t\tts_diff = jiffies - iostat_ctx->submit_ts;\n  224\t\tif (page_type >= META_FLUSH)\n                                 ^^^^^^^^^^\n\n  225\t\t\tpage_type = META;\n  226\n  227\t\tspin_lock_irqsave(&sbi->iostat_lat_lock, flags);\n @228\t\tio_lat->sum_lat[type][page_type] += ts_diff;\n                                      ^^^^^^^^^\nMixup between META_FLUSH and NR_PAGE_TYPE leads to memory corruption.","publishedAt":"2025-09-15T14:21:42.331Z","updatedAt":"2026-08-05T09:13:07.520Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"aa4d726af72a21732ce120484e0b1240674a13b3","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"22ddbbff116ee7dce5431feb1c0f36a507d2d68d","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"20b4f3de0f3932f71b4a8daf0671e517a8d98022","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/iostat.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.100","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.18","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.5","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/iostat.c"]}],"references":["https://git.kernel.org/stable/c/aa4d726af72a21732ce120484e0b1240674a13b3","https://git.kernel.org/stable/c/22ddbbff116ee7dce5431feb1c0f36a507d2d68d","https://git.kernel.org/stable/c/20b4f3de0f3932f71b4a8daf0671e517a8d98022","https://git.kernel.org/stable/c/0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53214.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53214","state":"PUBLISHED","datePublished":"2025-09-15T14:21:42.331Z","dateUpdated":"2026-08-05T09:13:07.520Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-15T14:19:21.845Z"},"containers":{"cna":{"title":"f2fs: fix to avoid potential memory corruption in __update_iostat_latency()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential memory corruption in __update_iostat_latency()\n\nAdd iotype sanity check to avoid potential memory corruption.\nThis is to fix the compile error below:\n\nfs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow\n'io_lat->peak_lat[type]' 3 <= 3\n\nvim +228 fs/f2fs/iostat.c\n\n  211  static inline void __update_iostat_latency(struct bio_iostat_ctx\n\t*iostat_ctx,\n  212\t\t\t\t\tenum iostat_lat_type type)\n  213  {\n  214\t\tunsigned long ts_diff;\n  215\t\tunsigned int page_type = iostat_ctx->type;\n  216\t\tstruct f2fs_sb_info *sbi = iostat_ctx->sbi;\n  217\t\tstruct iostat_lat_info *io_lat = sbi->iostat_io_lat;\n  218\t\tunsigned long flags;\n  219\n  220\t\tif (!sbi->iostat_enable)\n  221\t\t\treturn;\n  222\n  223\t\tts_diff = jiffies - iostat_ctx->submit_ts;\n  224\t\tif (page_type >= META_FLUSH)\n                                 ^^^^^^^^^^\n\n  225\t\t\tpage_type = META;\n  226\n  227\t\tspin_lock_irqsave(&sbi->iostat_lat_lock, flags);\n @228\t\tio_lat->sum_lat[type][page_type] += ts_diff;\n                                      ^^^^^^^^^\nMixup between META_FLUSH and NR_PAGE_TYPE leads to memory corruption."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"aa4d726af72a21732ce120484e0b1240674a13b3","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"22ddbbff116ee7dce5431feb1c0f36a507d2d68d","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"20b4f3de0f3932f71b4a8daf0671e517a8d98022","versionType":"git"},{"version":"a4b6817625e71d5d4aee16cacf7a7fec077c6dbe","status":"affected","lessThan":"0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/iostat.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.100","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.18","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.5","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/iostat.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/aa4d726af72a21732ce120484e0b1240674a13b3"},{"url":"https://git.kernel.org/stable/c/22ddbbff116ee7dce5431feb1c0f36a507d2d68d"},{"url":"https://git.kernel.org/stable/c/20b4f3de0f3932f71b4a8daf0671e517a8d98022"},{"url":"https://git.kernel.org/stable/c/0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path runs in f2fs bio completion (`f2fs_write_end_io`/`f2fs_read_end_io` → `iostat_update_and_unbind_ctx` → `__update_iostat_latency`) after ordinary local file I/O on an f2fs volume (e.g. Android userdata); it is not reachable via network protocols or adjacent-link frames.\nAC:H - Corruption requires `iostat_enable` (defaults false) and `iostat_ctx->type == NR_PAGE_TYPE`, but every submit site only passes DATA/NODE/META/META_FLUSH and META_FLUSH is already remapped by the old `>= META_FLUSH` check, so the out-of-bounds index is not attacker-influencable.\nPR:L - In the worst reasonable deployment (f2fs already mounted, iostat enabled for diagnostics as the feature intends), unprivileged local users/apps can issue reads/writes that drive bio completion through the vulnerable function without needing init-namespace root.\nUI:N - On typical f2fs deployments such as Android userdata the filesystem is already mounted, and the attacker triggers I/O themselves with no separate victim action required.\nS:U - Impact is confined to host kernel heap/state within the same OS security authority; there is no VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - When the bad index is used with WRITE_ASYNC_IO, `bio_cnt[idx][iotype]++` performs a read-modify-write one `unsigned int` past the kmalloc'd `iostat_lat_info`, which per OOB/memory-corruption guidance can be leveraged for disclosure of adjacent heap contents.\nI:H - The same path is a real heap out-of-bounds write (and in-object corruption of `peak_lat`/`bio_cnt`), which per kernel CVSS guidance for OOB writes is Integrity High and can yield write/control-flow primitives.\nA:H - Heap corruption adjacent to `iostat_io_lat` can cause kernel oops/panic when corrupted neighboring objects are later used, matching Availability High for memory-corruption crashes."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:13:07.520Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-53214","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T17:48:59.388842Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T17:52:57.442Z"}}]}}}