CVE-2024-27032

What it actually does

During f2fs recovery, enabling FAULT_BLOCK fault injection can cause f2fs_reserve_new_block to return -ENOSPC, hitting a BUG_ON that panics the kernel; additionally, a fault injection rate of 1 with only FAULT_BLOCK enabled can create an unbounded reservation loop.

Why it matters to the business

Systems using f2fs may experience unexpected crashes or hangs during filesystem recovery after power loss or unclean shutdowns, leading to downtime and potential data unavailability until the system is rebooted or the filesystem is repaired.

How an attack unfolds

An attacker with local access or the ability to induce filesystem faults (via fault injection or crafted workloads) can trigger f2fs recovery paths that hit the reservation failure or loop condition, resulting in denial of service through kernel panic or deadlock.

How to fix it

Upgrade the Linux kernel to a version containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; rebuild and reboot with the patched kernel. Disable fault injection in production f2fs environments until patched.

How to confirm the fix worked

Confirm the running kernel contains commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be via 'uname -r' and kernel source; attempt to reproduce the original fault-injection recovery scenario and verify neither panic nor deadlock occurs.

Typical attack path

1. Trigger f2fs recovery by forcing an unclean unmount or power cycle on an f2fs volume.
2. Enable FAULT_BLOCK fault injection (or equivalent error injection) during the recovery phase.
3. Observe BUG_ON panic on block reservation failure or indefinite loop consuming CPU.

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) around f2fs mount or recovery timestamps for BUG_ON messages, -ENOSPC during block reservation, or repeated reservation attempts; correlate with f2fs mount options or fault-injection settings.

What your security team should do

• Prioritize kernel updates for all systems using f2fs filesystems.
• Review and disable unnecessary fault-injection mechanisms in production.
• Monitor for f2fs recovery events in system logs after patching.