CVE-2024-33847

What it actually does

The flaw permits partial unaligned truncation on f2fs compressed inodes after release_cblocks, causing .i_blocks and total_valid_block_count to desync from actual allocated blocks and triggering filesystem corruption on unmount.

Why it matters to the business

Systems using f2fs with compression enabled risk metadata corruption that can render filesystems unmountable, force lengthy fsck runs, and result in data loss or downtime on affected Linux kernels.

How an attack unfolds

An attacker with local write access creates a compressed file, writes data, releases its compressed blocks, then performs an unaligned truncate; on remount fsck detects invalid block counts and marks the volume corrupted.

How to fix it

Upgrade the Linux kernel to a version containing commit b8962cf98595d1ec62f40f23667de830567ec8bc or later; restrict unprivileged users from performing truncate operations on compressed f2fs files until patched.

How to confirm the fix worked

Verify the running kernel contains commit b8962cf98595d1ec62f40f23667de830567ec8bc; attempt the published reproduction steps on a test f2fs image and confirm fsck reports no block-count mismatches after the fix.

Typical attack path

1. mkfs.f2fs with compression enabled on a block device
2. mount the f2fs filesystem
3. create a file and enable compression flags
4. write data to the file
5. release compressed blocks via f2fs_io
6. truncate the file to an unaligned size
7. unmount and run fsck to observe corruption

How to detect it

Review kernel logs and fsck output for ASSERT messages about i_blocks mismatch or valid_block_count failures on f2fs; search for sequences of release_cblocks followed by unaligned truncate operations in audit or process logs.

• [ASSERT] (fsck_chk_inode_blk:1256) ino: has i_blocks
• valid_block_count matching with CP [Fail]
• other corrupted bugs [Fail]

What your security team should do

• Apply the kernel update containing b8962cf98595d1ec62f40f23667de830567ec8bc immediately on all systems using f2fs compression
• Audit f2fs mount options and disable compression where not required
• Monitor fsck logs for valid_block_count mismatches on f2fs volumes
• Restrict local user access to f2fs filesystems until patches are deployed