CVE-2023-54182 (GCVE-0-2023-54182)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 09:17
VLAI
Title
f2fs: fix to check readonly condition correctly
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to check readonly condition correctly With below case, it can mount multi-device image w/ rw option, however one of secondary device is set as ro, later update will cause panic, so let's introduce f2fs_dev_is_readonly(), and check multi-devices rw status in f2fs_remount() w/ it in order to avoid such inconsistent mount status. mkfs.f2fs -c /dev/zram1 /dev/zram0 -f blockdev --setro /dev/zram1 mount -t f2fs dev/zram0 /mnt/f2fs mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only. mount -t f2fs -o remount,rw mnt/f2fs dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=8192 kernel BUG at fs/f2fs/inline.c:258! RIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs] Call Trace: f2fs_write_single_data_page+0x26b/0x9f0 [f2fs] f2fs_write_cache_pages+0x389/0xa60 [f2fs] __f2fs_write_data_pages+0x26b/0x2d0 [f2fs] f2fs_write_data_pages+0x2e/0x40 [f2fs] do_writepages+0xd3/0x1b0 __writeback_single_inode+0x5b/0x420 writeback_sb_inodes+0x236/0x5a0 __writeback_inodes_wb+0x56/0xf0 wb_writeback+0x2a3/0x490 wb_do_writeback+0x2b2/0x330 wb_workfn+0x6a/0x260 process_one_work+0x270/0x5e0 worker_thread+0x52/0x3e0 kthread+0xf4/0x120 ret_from_fork+0x29/0x50
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f824deb54b683165b953371a0529446c723ef6d6 , < e2759a59a4cc96af712084e9db7065c858c4fe9f (git)
Affected: f824deb54b683165b953371a0529446c723ef6d6 , < e05d63f8b48aad4613bd582c945bee41e2dd7255 (git)
Affected: f824deb54b683165b953371a0529446c723ef6d6 , < da8c535b28696017e5d1532d12ea78e836432d9e (git)
Affected: f824deb54b683165b953371a0529446c723ef6d6 , < d78dfefcde9d311284434560d69c0478c55a657e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2759a59a4cc96af712084e9db7065c858c4fe9f",
              "status": "affected",
              "version": "f824deb54b683165b953371a0529446c723ef6d6",
              "versionType": "git"
            },
            {
              "lessThan": "e05d63f8b48aad4613bd582c945bee41e2dd7255",
              "status": "affected",
              "version": "f824deb54b683165b953371a0529446c723ef6d6",
              "versionType": "git"
            },
            {
              "lessThan": "da8c535b28696017e5d1532d12ea78e836432d9e",
              "status": "affected",
              "version": "f824deb54b683165b953371a0529446c723ef6d6",
              "versionType": "git"
            },
            {
              "lessThan": "d78dfefcde9d311284434560d69c0478c55a657e",
              "status": "affected",
              "version": "f824deb54b683165b953371a0529446c723ef6d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet\u0027s introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n  f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n  f2fs_write_data_pages+0x2e/0x40 [f2fs]\n  do_writepages+0xd3/0x1b0\n  __writeback_single_inode+0x5b/0x420\n  writeback_sb_inodes+0x236/0x5a0\n  __writeback_inodes_wb+0x56/0xf0\n  wb_writeback+0x2a3/0x490\n  wb_do_writeback+0x2b2/0x330\n  wb_workfn+0x6a/0x260\n  process_one_work+0x270/0x5e0\n  worker_thread+0x52/0x3e0\n  kthread+0xf4/0x120\n  ret_from_fork+0x29/0x50"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local filesystem operations \u2014 a mount/remount syscall on a local block device followed by ordinary file writes on the mounted f2fs volume. There is no network-facing component in fs/f2fs/super.c or the writeback path.\nAC:L - Once a multi-device f2fs volume with a read-only secondary device has been remounted read-write, writing any file larger than MAX_INLINE_DATA deterministically drives f2fs_write_inline_data() into f2fs_bug_on(sbi, page-\u003eindex) with 100% reliability. There is no race to win and no memory layout to groom.\nPR:L - The final trigger requires only an unprivileged local user with write access to the mounted filesystem \u2014 the inconsistent RW state is created by the kernel wrongly accepting a remount that mount(8) itself flagged as write-protected, which an admin will naturally attempt after seeing the \"source write-protected, mounted read-only\" warning. No capability is needed to issue the writes that panic the kernel.\nUI:N - No victim action is needed at exploitation time; the attacker simply writes to a file and the writeback kworker hits the BUG asynchronously. The vulnerable mount state is a pre-existing system condition, not an interaction the attacker must induce.\nS:U - The impact is confined to the kernel and the affected filesystem within the same security authority \u2014 there is no VM, sandbox, or IOMMU boundary crossed.\nC:N - All data movement in the affected paths (f2fs_do_read_inline_data, f2fs_truncate_inline_inode, f2fs_write_inline_data) is bounded by MAX_INLINE_DATA(inode) inside the inode\u0027s own node page, so there is no out-of-bounds read, no uninitialized memory exposure, and no cross-file disclosure.\nI:H - The inconsistent mount lets f2fs_convert_inline_inode() silently skip conversion, so an inode retains FI_INLINE_DATA while holding data blocks past index 0; the WARN path then memcpy\u0027s the wrong page into the inline data area and writes to the read-only member device are rejected by bio_check_ro(), producing on-disk data and metadata corruption, checkpoint errors, and a filesystem flagged SBI_NEED_FSCK.\nA:H - With CONFIG_F2FS_CHECK_FS the assertion is a hard BUG_ON that panics the kernel from the writeback kworker (the exact \"kernel BUG at fs/f2fs/inline.c:258\" reported in the fix). Even without it, the resulting I/O failures on the read-only device drive the filesystem into a checkpoint-error state, taking the volume offline."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:51.173Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255"
        },
        {
          "url": "https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"
        }
      ],
      "title": "f2fs: fix to check readonly condition correctly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54182",
    "datePublished": "2025-12-30T12:08:53.092Z",
    "dateReserved": "2025-12-30T12:06:44.497Z",
    "dateUpdated": "2026-08-05T09:17:51.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54182",
      "date": "2026-09-28",
      "epss": "0.0015",
      "percentile": "0.03528"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/f2fs.h",
                  "fs/f2fs/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e2759a59a4cc96af712084e9db7065c858c4fe9f",
                    "status": "affected",
                    "version": "f824deb54b683165b953371a0529446c723ef6d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e05d63f8b48aad4613bd582c945bee41e2dd7255",
                    "status": "affected",
                    "version": "f824deb54b683165b953371a0529446c723ef6d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da8c535b28696017e5d1532d12ea78e836432d9e",
                    "status": "affected",
                    "version": "f824deb54b683165b953371a0529446c723ef6d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d78dfefcde9d311284434560d69c0478c55a657e",
                    "status": "affected",
                    "version": "f824deb54b683165b953371a0529446c723ef6d6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/f2fs.h",
                  "fs/f2fs/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check readonly condition correctly\n\nWith below case, it can mount multi-device image w/ rw option, however\none of secondary device is set as ro, later update will cause panic, so\nlet\u0027s introduce f2fs_dev_is_readonly(), and check multi-devices rw status\nin f2fs_remount() w/ it in order to avoid such inconsistent mount status.\n\nmkfs.f2fs -c /dev/zram1 /dev/zram0 -f\nblockdev --setro /dev/zram1\nmount -t f2fs dev/zram0 /mnt/f2fs\nmount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.\nmount -t f2fs -o remount,rw mnt/f2fs\ndd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192\n\nkernel BUG at fs/f2fs/inline.c:258!\nRIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]\nCall Trace:\n  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]\n  f2fs_write_cache_pages+0x389/0xa60 [f2fs]\n  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]\n  f2fs_write_data_pages+0x2e/0x40 [f2fs]\n  do_writepages+0xd3/0x1b0\n  __writeback_single_inode+0x5b/0x420\n  writeback_sb_inodes+0x236/0x5a0\n  __writeback_inodes_wb+0x56/0xf0\n  wb_writeback+0x2a3/0x490\n  wb_do_writeback+0x2b2/0x330\n  wb_workfn+0x6a/0x260\n  process_one_work+0x270/0x5e0\n  worker_thread+0x52/0x3e0\n  kthread+0xf4/0x120\n  ret_from_fork+0x29/0x50"
          }
        ],
        "id": "CVE-2023-54182",
        "lastModified": "2026-08-04T11:16:35.453",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:06.140",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d78dfefcde9d311284434560d69c0478c55a657e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e2759a59a4cc96af712084e9db7065c858c4fe9f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T19:29:42+00:00",
      "cve": "CVE-2023-54182",
      "id": "CVE-2023-54182",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: f2fs denial of service from incorrect read-only check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54182.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:53:24Z",
      "cve": "CVE-2023-54182",
      "id": "CVE-2023-54182",
      "initial_release_date": "2025-12-31T00:29:05Z",
      "product_status:known_affected": "201",
      "product_status:known_not_affected": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54182",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54182.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.