CVE-2024-27069

What it actually does

Race condition in overlayfs copy-up path allows lower-layer file size to change concurrently, triggering a WARN_ON assertion in ovl_verify_area() instead of returning EIO.

Why it matters to the business

Systems using overlay filesystems (containers, layered storage) may experience kernel warnings, instability, or crashes when lower-layer files are modified during copy-up operations, increasing operational risk in shared environments.

How an attack unfolds

An attacker with write access to a lower layer modifies file size during an overlayfs copy-up operation, hitting the assertion that was previously treated as a hard failure rather than a recoverable error condition.

How to fix it

Upgrade Linux kernel to version 6.8.2 or later, or apply commit c3c85aefc0da1e5074a06c682542a54ccc99bdca in stable trees; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is 6.8.2 or newer; confirm the ovl_verify_area() change is present in the source tree; test copy-up workloads with concurrent lower-layer size changes to ensure EIO is returned cleanly.

Typical attack path

1. Obtain write access to a lower filesystem layer used by overlayfs
2. Trigger or race a copy-up operation on a file whose size is being altered
3. Cause the kernel to enter ovl_verify_area() with inconsistent size state
4. Trigger the WARN_ON assertion leading to potential denial of service or log flooding

How to detect it

Search kernel logs for WARN_ON messages containing ovl_verify_area or overlayfs copy-up assertions; look for EIO errors on copy-up operations that previously would have panicked; correlate with processes performing writes to lower overlay layers.

What your security team should do

• Prioritize kernel upgrades on all systems using overlayfs (containers, build systems, desktop environments)
• Monitor for kernel WARN messages referencing ovl_verify_area after patching
• Review container runtime and storage configurations for lower-layer mutability risks