CVE-2024-42273

What it actually does

Triggers a kernel BUG_ON in f2fs segment.c during data page writeback when a compressed file is truncated after setting the GCing flag on a COMPR_ADDR page, causing invalid segment assignment for CURSEG_ALL_DATA_ATGC.

Why it matters to the business

Local users on systems using the f2fs filesystem with compression enabled can crash the kernel, leading to denial of service, potential data corruption on affected mounts, and operational downtime; urgency is low given no known exploitation or ransomware use despite broad Linux kernel prevalence.

How an attack unfolds

An attacker with local access creates a compressed directory on an f2fs mount, writes a small file, truncates it to an invalid size, and triggers writeback that hits the unhandled COMPR_ADDR case during segment selection, resulting in the BUG; no named threat actors or campaigns are tied to active exploitation of this specific flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit df0cc57e057f18e44dac8e6c18aba47ab53202f9; rebuild and reboot with the patched f2fs module; disable compression on f2fs mounts as a temporary mitigation if upgrade is delayed.

How to confirm the fix worked

Confirm kernel version includes df0cc57e057f18e44dac8e6c18aba47ab53202f9; reproduce the mkdir/setflags/dd/truncate sequence and verify absence of BUG at fs/f2fs/segment.c:3589; scan dmesg for resolved f2fs compression handling.

Typical attack path

1. Mount f2fs filesystem with compression support
2. Create directory and enable compression flags
3. Write a 16k file then truncate to 13 bytes
4. Force writeback or page cache flush to invoke f2fs_write_data_pages
5. Trigger BUG_ON at segment.c:3589 during CURSEG_ALL_DATA_ATGC assignment

How to detect it

Search kernel logs (dmesg, syslog, journalctl) for the exact BUG string at fs/f2fs/segment.c:3589 or traces involving f2fs_write_multi_pages and set_cluster_dirty; correlate with f2fs mount events and compression flag changes; no widespread threat actor IOCs reported.

• kernel BUG at fs/f2fs/segment.c:3589
• f2fs_outplace_write_data+0x62/0xb0
• set_cluster_dirty
• CURSEG_ALL_DATA_ATGC

What your security team should do

• Prioritize kernel updates on all f2fs-using systems within standard patch cycles
• Audit f2fs mounts for compression usage and restrict local user write access where feasible
• Monitor kernel logs for f2fs segment.c BUG_ON entries as part of routine detection