CVE-2023-53763

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Revert "f2fs: fix to do sanity check on extent cache correctly"<br /> <br /> syzbot reports a f2fs bug as below:<br /> <br /> UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19<br /> index 1409 is out of range for type &amp;#39;__le32[923]&amp;#39; (aka &amp;#39;unsigned int[923]&amp;#39;)<br /> Call Trace:<br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106<br /> ubsan_epilogue lib/ubsan.c:217 [inline]<br /> __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348<br /> inline_data_addr fs/f2fs/f2fs.h:3275 [inline]<br /> __recover_inline_status fs/f2fs/inode.c:113 [inline]<br /> do_read_inode fs/f2fs/inode.c:480 [inline]<br /> f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604<br /> f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601<br /> mount_bdev+0x276/0x3b0 fs/super.c:1391<br /> legacy_get_tree+0xef/0x190 fs/fs_context.c:611<br /> vfs_get_tree+0x8c/0x270 fs/super.c:1519<br /> do_new_mount+0x28f/0xae0 fs/namespace.c:3335<br /> do_mount fs/namespace.c:3675 [inline]<br /> __do_sys_mount fs/namespace.c:3884 [inline]<br /> __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> The issue was bisected to:<br /> <br /> commit d48a7b3a72f121655d95b5157c32c7d555e44c05<br /> Author: Chao Yu <br /> Date: Mon Jan 9 03:49:20 2023 +0000<br /> <br /> f2fs: fix to do sanity check on extent cache correctly<br /> <br /> The root cause is we applied both v1 and v2 of the patch, v2 is the right<br /> fix, so it needs to revert v1 in order to fix reported issue.<br /> <br /> v1:<br /> commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly")<br /> https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/<br /> <br /> v2:<br /> commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly")<br /> https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/