{"id":"CVE-2023-54182","state":"PUBLISHED","title":"f2fs: fix to check readonly condition correctly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet's introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n  f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n  f2fs_write_data_pages+0x2e/0x40 [f2fs]\n  do_writepages+0xd3/0x1b0\n  __writeback_single_inode+0x5b/0x420\n  writeback_sb_inodes+0x236/0x5a0\n  __writeback_inodes_wb+0x56/0xf0\n  wb_writeback+0x2a3/0x490\n  wb_do_writeback+0x2b2/0x330\n  wb_workfn+0x6a/0x260\n  process_one_work+0x270/0x5e0\n  worker_thread+0x52/0x3e0\n  kthread+0xf4/0x120\n  ret_from_fork+0x29/0x50","publishedAt":"2025-12-30T12:08:53.092Z","updatedAt":"2026-08-05T09:17:51.173Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"e2759a59a4cc96af712084e9db7065c858c4fe9f","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"e05d63f8b48aad4613bd582c945bee41e2dd7255","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"da8c535b28696017e5d1532d12ea78e836432d9e","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"d78dfefcde9d311284434560d69c0478c55a657e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.2","versionType":"semver"},{"version":"5.15.113","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.30","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.3.4","status":"unaffected","lessThanOrEqual":"6.3.*","versionType":"semver"},{"version":"6.4","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"]}],"references":["https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f","https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255","https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e","https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/54xxx/CVE-2023-54182.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-54182","state":"PUBLISHED","datePublished":"2025-12-30T12:08:53.092Z","dateUpdated":"2026-08-05T09:17:51.173Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-30T12:06:44.497Z"},"containers":{"cna":{"title":"f2fs: fix to check readonly condition correctly","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet's introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n  f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n  f2fs_write_data_pages+0x2e/0x40 [f2fs]\n  do_writepages+0xd3/0x1b0\n  __writeback_single_inode+0x5b/0x420\n  writeback_sb_inodes+0x236/0x5a0\n  __writeback_inodes_wb+0x56/0xf0\n  wb_writeback+0x2a3/0x490\n  wb_do_writeback+0x2b2/0x330\n  wb_workfn+0x6a/0x260\n  process_one_work+0x270/0x5e0\n  worker_thread+0x52/0x3e0\n  kthread+0xf4/0x120\n  ret_from_fork+0x29/0x50"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"e2759a59a4cc96af712084e9db7065c858c4fe9f","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"e05d63f8b48aad4613bd582c945bee41e2dd7255","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"da8c535b28696017e5d1532d12ea78e836432d9e","versionType":"git"},{"version":"f824deb54b683165b953371a0529446c723ef6d6","status":"affected","lessThan":"d78dfefcde9d311284434560d69c0478c55a657e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.2","versionType":"semver"},{"version":"5.15.113","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.30","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.3.4","status":"unaffected","lessThanOrEqual":"6.3.*","versionType":"semver"},{"version":"6.4","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/super.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f"},{"url":"https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255"},{"url":"https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e"},{"url":"https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through local filesystem operations — a mount/remount syscall on a local block device followed by ordinary file writes on the mounted f2fs volume. There is no network-facing component in fs/f2fs/super.c or the writeback path.\nAC:L - Once a multi-device f2fs volume with a read-only secondary device has been remounted read-write, writing any file larger than MAX_INLINE_DATA deterministically drives f2fs_write_inline_data() into f2fs_bug_on(sbi, page->index) with 100% reliability. There is no race to win and no memory layout to groom.\nPR:L - The final trigger requires only an unprivileged local user with write access to the mounted filesystem — the inconsistent RW state is created by the kernel wrongly accepting a remount that mount(8) itself flagged as write-protected, which an admin will naturally attempt after seeing the \"source write-protected, mounted read-only\" warning. No capability is needed to issue the writes that panic the kernel.\nUI:N - No victim action is needed at exploitation time; the attacker simply writes to a file and the writeback kworker hits the BUG asynchronously. The vulnerable mount state is a pre-existing system condition, not an interaction the attacker must induce.\nS:U - The impact is confined to the kernel and the affected filesystem within the same security authority — there is no VM, sandbox, or IOMMU boundary crossed.\nC:N - All data movement in the affected paths (f2fs_do_read_inline_data, f2fs_truncate_inline_inode, f2fs_write_inline_data) is bounded by MAX_INLINE_DATA(inode) inside the inode's own node page, so there is no out-of-bounds read, no uninitialized memory exposure, and no cross-file disclosure.\nI:H - The inconsistent mount lets f2fs_convert_inline_inode() silently skip conversion, so an inode retains FI_INLINE_DATA while holding data blocks past index 0; the WARN path then memcpy's the wrong page into the inline data area and writes to the read-only member device are rejected by bio_check_ro(), producing on-disk data and metadata corruption, checkpoint errors, and a filesystem flagged SBI_NEED_FSCK.\nA:H - With CONFIG_F2FS_CHECK_FS the assertion is a hard BUG_ON that panics the kernel from the writeback kworker (the exact \"kernel BUG at fs/f2fs/inline.c:258\" reported in the fix). Even without it, the resulting I/O failures on the read-only device drive the filesystem into a checkpoint-error state, taking the volume offline."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:17:51.173Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.15.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.1.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.3.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.4"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}