CVE-2024-41935

What it actually does

The vulnerability in the f2fs filesystem causes the rwlock protecting the extent tree to be held for excessively long periods during shrink operations when many extent nodes are present, potentially leading to kernel hangs.

Why it matters to the business

Systems using the f2fs filesystem may experience hangs or unresponsiveness, impacting availability of Linux-based servers and devices.

How an attack unfolds

An attacker with the ability to influence extent tree operations in f2fs could trigger repeated shrink operations on large trees to hold the rwlock and cause system instability.

How to fix it

Update the Linux kernel to include the fix in commit 295b50e95e900da31ff237e46e04525fa799b2cf or apply the corresponding package updates for affected distributions such as the listed Ubuntu imagemagick fixes where relevant.

How to confirm the fix worked

Verify the kernel version includes the batch shrink fix for read extent nodes and test under high extent node load to ensure no prolonged lock holds.

Typical attack path

1. Gain local access to a system using f2fs
2. Manipulate filesystem operations to create large extent trees
3. Trigger shrink operations to hold locks long-term
4. Cause kernel hang or denial of service

How to detect it

Check system logs for f2fs extent tree related warnings or kernel hang traces involving rwlocks during shrink operations.

What your security team should do

• Prioritize kernel updates on systems using f2fs
• Monitor for kernel hang issues related to f2fs
• Review filesystem usage and consider alternatives if updates delayed