CVE-2024-39467

What it actually does

Missing sanity check on i_xattr_nid allows invalid node ID to reach current_nat_addr and f2fs_get_node_info, causing slab-out-of-bounds read during fiemap ioctl on f2fs.

Why it matters to the business

Systems using the f2fs filesystem may experience kernel crashes or denial of service when processing specially crafted images or performing fiemap operations; high ecosystem prevalence increases exposure for Linux-based devices and servers.

How an attack unfolds

An attacker supplies a malicious f2fs filesystem image containing an inode with an invalid i_xattr_nid value. When the kernel mounts the image and a process issues an fiemap ioctl, f2fs_fiemap calls f2fs_get_node_info which indexes into nat_bitmap using the unchecked offset, triggering the out-of-bounds access.

How to fix it

Apply the upstream fix in commit c559a8d840562fbfce9f318448dda2f7d3e6d8e8 (or equivalent 735e7fa2814edeec9a2c07778ed51b3c018609f9) and update to a patched kernel version; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the presence of sanity_check_inode call on i_xattr_nid after upgrade; attempt to reproduce the original syzbot reproducer and confirm absence of KASAN report; check kernel git log for the cited commit.

Typical attack path

1. Craft or obtain f2fs image with inode having invalid i_xattr_nid
2. Mount the image on a vulnerable kernel
3. Issue fiemap ioctl against a file on the mounted filesystem
4. Trigger slab-out-of-bounds read in f2fs_get_node_info

How to detect it

Search kernel logs for F2FS-fs mount messages followed by KASAN slab-out-of-bounds reports referencing f2fs_get_node_info or current_nat_addr; inspect fiemap ioctl usage in audit logs.

• BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info
• f2fs_test_bit fs/f2fs/f2fs.h:2933
• current_nat_addr fs/f2fs/node.h:213
• F2FS-fs (loop0): Mounted with checkpoint version

What your security team should do

• Prioritize patching Linux kernels using f2fs on all production and Android-derived systems
• Monitor for f2fs mount and fiemap activity in high-risk environments
• Test patched kernels with f2fs workloads before broad deployment