CVE-2023-52682

f2fs: fix to wait on block writeback for post_read case

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait on block writeback for post_read case If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io

N/A

CVSS

Severity:

EPSS 0.07%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/9bfd5ea71521d0e522ba581c6ccc5db93759c0c3
https://git.kernel.org/stable/c/4535be48780431753505e74e1b1ad4836a189bc2
https://git.kernel.org/stable/c/f904c156d8011d8291ffd5b6b398f3747e294986
https://git.kernel.org/stable/c/55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00

Frequently Asked Questions

What is the severity of CVE-2023-52682?: CVE-2023-52682 has not yet been assigned a CVSS score.
How to fix CVE-2023-52682?: To fix CVE-2023-52682, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-52682 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2023-52682 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-52682?: CVE-2023-52682 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.