f2fs: Fix Sanity Check on Last Xattr Entry in __f2fs_setxattr()
Summary
GSD-2021-1002842: f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr(). Affects Kernel versions < a8a9d753edd7f71e6a2edaa580d8182530b68791. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The f2fs package is a file system designed for flash-based storage devices in the Linux kernel. It provides efficient data management and supports advanced features such as transparent compression and encryption. The __f2fs_setxattr() function is responsible for setting extended attributes (xattrs) on files in the f2fs file system.
Vulnerability Detail
The vulnerability in the f2fs package lies in the __f2fs_setxattr() function. It fails to perform a sanity check on the last xattr entry, which can lead to a potential security issue. An attacker could exploit this vulnerability to manipulate or corrupt xattrs, potentially compromising the integrity or confidentiality of the file system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The f2fs package in the Linux kernel is vulnerable to a security issue in the __f2fs_setxattr() function. Updating the kernel to version v5.15.12 or later is advised to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to manipulate or corrupt xattrs in the f2fs file system, compromising its integrity or confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
There are no known exploits for this vulnerability at the time of this report.
Yes, a patch is available in the Linux kernel version v5.15.12 or later. It can be obtained from the official Linux kernel repository.
Yes, updating the Linux kernel to version v5.15.12 or later is recommended to fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
