CVE-2023-52588 (GCVE-0-2023-52588)
Vulnerability from cvelistv5
Published
2024-03-06 06:45
Modified
2026-08-05 09:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to tag gcing flag on page during block migration
It needs to add missing gcing flag on page during block migration,
in order to garantee migrated data be persisted during checkpoint,
otherwise out-of-order persistency between data and node may cause
data corruption after SPOR.
Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag
gcing flag on page during file defragment").
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:03:21.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52588",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-15T19:26:08.215846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T19:26:15.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c",
"fs/f2fs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ea0f29d9fd84905051be020c0df7d557e286136",
"status": "affected",
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
"versionType": "git"
},
{
"lessThan": "7c972c89457511007dfc933814c06786905e515c",
"status": "affected",
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
"versionType": "git"
},
{
"lessThan": "417b8a91f4e8831cadaf85c3f15c6991c1f54dde",
"status": "affected",
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
"versionType": "git"
},
{
"lessThan": "b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3",
"status": "affected",
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
"versionType": "git"
},
{
"lessThan": "4961acdd65c956e97c1a000c82d91a8c1cdbe44b",
"status": "affected",
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/compress.c",
"fs/f2fs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.149",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.149",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.77",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.16",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.4",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local f2fs paths (fallocate COLLAPSE/INSERT and F2FS_IOC_MOVE_RANGE \u2192 __clone_blkaddrs; write(2) to compressed files \u2192 set_cluster_dirty; F2FS_IOC_COMPRESS/DECOMPRESS_FILE \u2192 redirty_blocks), not via network or adjacent-link protocol handlers.\nAC:L - An unprivileged attacker can reliably create the inconsistent state by migrating blocks and forcing checkpoint via sync/syncfs/fsync; checkpoint deterministically skips non-gcing data pages (waits only on F2FS_WB_CP_DATA), and SPOR is an expected f2fs recovery condition on Android/embedded deployments rather than an attacker-uncontrollable race.\nPR:L - Triggering requires only ordinary write access to a file on a mounted f2fs volume (fallocate/write/ioctl with FMODE_WRITE); the compress/decompress and fallocate paths have no CAP_SYS_ADMIN check, and owners can enable compression via FS_IOC_SETFLAGS.\nUI:N - On typical f2fs deployments (e.g. Android userdata) the filesystem is already mounted; the attacker triggers migration and checkpointing entirely with their own syscalls, with no separate victim action required.\nS:U - Impact is confined to on-disk f2fs file/metadata integrity within the same kernel security authority; there is no VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:L - After SPOR, node metadata can reference newly allocated blocks that were never written, so reads return prior on-disk contents of those LFS blocks (potentially another user\u0027s deleted data), but without active cross-linking of live files this is limited disclosure rather than arbitrary memory read.\nI:H - Out-of-order persistency between migrated data and node pages causes silent, durable corruption or loss of file contents after sudden power-off, matching the fix description and other f2fs CP-persistence integrity bugs.\nA:H - Corrupted migrated/compressed clusters can permanently fail reads (wrong or undecompressible data), surface -EIO/-EFSCORRUPTED, and flag SBI_NEED_FSCK\u2014on Android/embedded f2fs userdata this is a durable availability loss requiring repair or data wipe."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:10:30.257Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136"
},
{
"url": "https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c"
},
{
"url": "https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde"
},
{
"url": "https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3"
},
{
"url": "https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b"
}
],
"title": "f2fs: fix to tag gcing flag on page during block migration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-52588",
"datePublished": "2024-03-06T06:45:21.925Z",
"dateReserved": "2024-03-02T21:55:42.570Z",
"dateUpdated": "2026-08-05T09:10:30.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.145Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52588\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-15T19:26:08.215846Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-15T19:26:12.962Z\"}}], \"cna\": {\"title\": \"f2fs: fix to tag gcing flag on page during block migration\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through local f2fs paths (fallocate COLLAPSE/INSERT and F2FS_IOC_MOVE_RANGE \\u2192 __clone_blkaddrs; write(2) to compressed files \\u2192 set_cluster_dirty; F2FS_IOC_COMPRESS/DECOMPRESS_FILE \\u2192 redirty_blocks), not via network or adjacent-link protocol handlers.\\nAC:L - An unprivileged attacker can reliably create the inconsistent state by migrating blocks and forcing checkpoint via sync/syncfs/fsync; checkpoint deterministically skips non-gcing data pages (waits only on F2FS_WB_CP_DATA), and SPOR is an expected f2fs recovery condition on Android/embedded deployments rather than an attacker-uncontrollable race.\\nPR:L - Triggering requires only ordinary write access to a file on a mounted f2fs volume (fallocate/write/ioctl with FMODE_WRITE); the compress/decompress and fallocate paths have no CAP_SYS_ADMIN check, and owners can enable compression via FS_IOC_SETFLAGS.\\nUI:N - On typical f2fs deployments (e.g. Android userdata) the filesystem is already mounted; the attacker triggers migration and checkpointing entirely with their own syscalls, with no separate victim action required.\\nS:U - Impact is confined to on-disk f2fs file/metadata integrity within the same kernel security authority; there is no VM escape, IOMMU bypass, or other cross-boundary breakout.\\nC:L - After SPOR, node metadata can reference newly allocated blocks that were never written, so reads return prior on-disk contents of those LFS blocks (potentially another user\u0027s deleted data), but without active cross-linking of live files this is limited disclosure rather than arbitrary memory read.\\nI:H - Out-of-order persistency between migrated data and node pages causes silent, durable corruption or loss of file contents after sudden power-off, matching the fix description and other f2fs CP-persistence integrity bugs.\\nA:H - Corrupted migrated/compressed clusters can permanently fail reads (wrong or undecompressible data), surface -EIO/-EFSCORRUPTED, and flag SBI_NEED_FSCK\\u2014on Android/embedded f2fs userdata this is a durable availability loss requiring repair or data wipe.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"7ea0f29d9fd84905051be020c0df7d557e286136\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"7c972c89457511007dfc933814c06786905e515c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"417b8a91f4e8831cadaf85c3f15c6991c1f54dde\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"4961acdd65c956e97c1a000c82d91a8c1cdbe44b\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/compress.c\", \"fs/f2fs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/compress.c\", \"fs/f2fs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ea0f29d9fd84905051be020c0df7d557e286136\"}, {\"url\": \"https://git.kernel.org/stable/c/7c972c89457511007dfc933814c06786905e515c\"}, {\"url\": \"https://git.kernel.org/stable/c/417b8a91f4e8831cadaf85c3f15c6991c1f54dde\"}, {\"url\": \"https://git.kernel.org/stable/c/b8094c0f1aae329b1c60a275a780d6c2c9ff7aa3\"}, {\"url\": \"https://git.kernel.org/stable/c/4961acdd65c956e97c1a000c82d91a8c1cdbe44b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to tag gcing flag on page during block migration\\n\\nIt needs to add missing gcing flag on page during block migration,\\nin order to garantee migrated data be persisted during checkpoint,\\notherwise out-of-order persistency between data and node may cause\\ndata corruption after SPOR.\\n\\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\\\"f2fs: fix to tag\\ngcing flag on page during file defragment\\\").\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.77\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.16\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.4\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"3.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:10:30.257Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-52588\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:10:30.257Z\", \"dateReserved\": \"2024-03-02T21:55:42.570Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-06T06:45:21.925Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…