CVE-2024-27034

What it actually does

Race condition in f2fs compressed cluster handling allows partial block writes to persist without atomic metadata update when cp_rwsem is released during f2fs_write_raw_pages, enabling data corruption on checkpoint or sudden power loss.

Why it matters to the business

Organizations running Linux kernels with f2fs compression may experience silent data corruption or loss on affected filesystems during concurrent overwrites of compressed clusters, increasing operational risk and potential recovery costs; widespread kernel usage amplifies exposure across servers and embedded devices.

How an attack unfolds

An attacker with local access crafts concurrent write operations that overwrite a compressed f2fs cluster with a normal cluster; by triggering the window where cp_rwsem is unlocked, partial blocks can be written before a checkpoint, resulting in inconsistent metadata and corruption after recovery.

How to fix it

Update the Linux kernel to a version containing commit 7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416 or later; rebuild and deploy the fixed kernel across all affected systems using f2fs.

How to confirm the fix worked

Confirm kernel source contains commit 7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416; test f2fs compressed cluster overwrite behavior under simulated checkpoint and power-loss conditions to verify atomic updates.

Typical attack path

1. Obtain local code execution or shell access on a system using f2fs with compression enabled
2. Perform concurrent writes that replace compressed cluster data with normal cluster data
3. Induce or wait for a checkpoint or sudden power-off recovery scenario
4. Observe or leverage resulting filesystem data corruption

How to detect it

Review f2fs filesystem logs and kernel messages for cluster write or checkpoint errors; inspect affected volumes for unexpected data inconsistencies after recovery events; correlate with application-level checksum failures on f2fs mounts.

What your security team should do

• Prioritize kernel upgrades on all production systems using f2fs compression within the next maintenance window
• Audit f2fs usage and disable compression where not required as a temporary mitigation
• Monitor vendor kernel update channels for backports of the referenced commit