CVE-2024-27070

What it actually does

Use-after-free in f2fs_filemap_fault when vmf->vma is accessed after filemap_fault may have freed the vma structure, allowing invalid memory reads of vm_flags.

Why it matters to the business

Linux systems using the f2fs filesystem may experience kernel crashes or memory corruption, leading to service outages and potential local privilege escalation on affected kernels before 6.8.2.

How an attack unfolds

An attacker with local access triggers a page fault on an f2fs-backed memory mapping; the race between filemap_fault and subsequent vma access in the tracepoint leads to a use-after-free read that can be leveraged for kernel memory disclosure or corruption.

How to fix it

Upgrade the Linux kernel to version 6.8.2 or apply the fix from commit 897761d16564e899faecb9381b4818858705081f in the stable tree; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm kernel version is at least 6.8.2; verify the presence of the commit 897761d16564e899faecb9381b4818858705081f in the source tree; run syzkaller-style fault injection tests targeting f2fs_filemap_fault to ensure the KASAN report no longer triggers.

Typical attack path

1. Obtain local unprivileged access on a system mounting f2fs
2. Map a file from f2fs into memory and trigger a page fault
3. Race the fault handler to free the vma before trace_f2fs_filemap_fault reads vm_flags
4. Use the resulting slab use-after-free for further kernel exploitation or denial of service

How to detect it

Search kernel logs and dmesg for KASAN reports containing f2fs_filemap_fault and slab-use-after-free; inspect audit logs for unusual page-fault activity on f2fs mounts; review crash dumps for references to fs/f2fs/file.c:49.

What your security team should do

• Prioritize patching production systems running f2fs to 6.8.2 within the next maintenance window
• Disable f2fs mounts on untrusted multi-user systems until patched
• Monitor kernel logs for KASAN reports mentioning f2fs_filemap_fault
• Update kernel build and deployment pipelines to enforce minimum version 6.8.2