Bug 2265267 (CVE-2023-52436)

Summary:	CVE-2023-52436 kernel: f2fs: explicitly null-terminate the xattr list
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sidakwo, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel’s f2fs subsystem. When setting an xattr, explicitly null-terminate the xattr list. This eliminates the assumption that the unused xattr space is always zeroed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-02-25 10:38:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2265268
Bug Blocks:	2265182

Description Avinash Hanwate 2024-02-21 08:21:00 UTC

In the Linux kernel, the following vulnerability has been resolved:

f2fs: explicitly null-terminate the xattr list

When setting an xattr, explicitly null-terminate the xattr list.  This eliminates the fragile assumption that the unused xattr space is always
zeroed.

https://git.kernel.org/stable/c/12cf91e23b126718a96b914f949f2cdfeadc7b2a
https://git.kernel.org/stable/c/16ae3132ff7746894894927c1892493693b89135
https://git.kernel.org/stable/c/2525d1ba225b5c167162fa344013c408e8b4de36
https://git.kernel.org/stable/c/32a6cfc67675ee96fe107aeed5af9776fec63f11
https://git.kernel.org/stable/c/3e47740091b05ac8d7836a33afd8646b6863ca52
https://git.kernel.org/stable/c/5de9e9dd1828db9b8b962f7ca42548bd596deb8a
https://git.kernel.org/stable/c/e26b6d39270f5eab0087453d9b544189a38c8564
https://git.kernel.org/stable/c/f6c30bfe5a49bc38cae985083a11016800708fea

Comment 1 Avinash Hanwate 2024-02-21 08:22:48 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2265268]

Comment 3 Eric Sandeen 2024-02-21 14:32:40 UTC

We don't build or ship F2FS in RHEL8 or RHEL8.

Comment 4 Justin M. Forbes 2024-02-21 22:54:35 UTC

This was fixed for Fedora with the 6.6.13 stable kernel updates.

Comment 5 Alex 2024-02-25 10:38:06 UTC

In reply to comment #3:
> We don't build or ship F2FS in RHEL8 or RHEL8.

Right, the
# CONFIG_F2FS_FS is not set

Comment 6 Alex 2024-06-09 13:07:29 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2023-52436 is: 	SKIP	No affected files built, so skip this CVE	NO			-	-	unknown (where first YES/NO value means if related sources built).