CVE-2024-43857

What it actually does

Null pointer dereference in is_end_zone_blkaddr() when f2fs is mounted on a single device, allowing a local process to trigger a kernel crash via zone-end block address checks.

Why it matters to the business

Local users on affected Linux systems can trigger kernel panics, leading to denial of service and potential data loss or service disruption; high downstream prevalence increases exposure across many Linux-based environments and products.

How an attack unfolds

An attacker with local access mounts an f2fs filesystem as a single device and performs operations that invoke is_end_zone_blkaddr() on the final block of a zone, dereferencing a null pointer and crashing the kernel.

How to fix it

Apply the upstream fix in commit b98777309756ebe15cc9ad4e8ab64bbfaf878a3f or later; update to a patched kernel version containing this commit. Reboot after upgrade and verify f2fs mounts succeed without triggering the path.

How to confirm the fix worked

Confirm the commit b98777309756ebe15cc9ad4e8ab64bbfaf878a3f (or equivalent backport) is present in the running kernel source; test single-device f2fs mounts and zone operations to ensure no null dereference occurs.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Create or access an f2fs filesystem configured as a single device
3. Trigger zone-end block address validation through filesystem operations or ioctls
4. Cause kernel panic via null pointer access in is_end_zone_blkaddr()

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for null pointer dereference oops messages referencing is_end_zone_blkaddr or f2fs zone handling around the time of unexpected reboots or panics.

What your security team should do

• Prioritize kernel updates on all systems using f2fs, especially those with high availability requirements
• Audit f2fs usage across the environment given the 29,569 downstream dependents
• Monitor for local privilege escalation attempts that could abuse the crash for further exploitation
• Apply the fix before any scheduled maintenance windows to meet standard patching cadence