Cloudanix VulnDB

CVE-2024-44942

None

CVSS

—

EPSS

0.2%

Published

Aug 26, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux file-system code can make the computer crash when it tries to clean up storage on certain formatted drives.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing sanity check on F2FS_INLINE_DATA flag in fuzzed inodes allows valid blkaddr entries in direct nodes; background GC then triggers f2fs_bug_on during dirty-page writeback in f2fs_write_inline_data.

Why it matters to the business

Systems using f2fs may experience sudden kernel crashes during routine writeback and garbage collection, causing downtime, data loss risk, and forced reboots on servers, mobile devices, and embedded Linux deployments.

How an attack unfolds

An attacker supplies a malicious f2fs filesystem image containing an inode with F2FS_INLINE_DATA set yet valid blkaddrs present; once mounted and background GC or writeback is triggered, the kernel hits the assertion and panics.

How to fix it

Upgrade Linux kernel to a release containing commit ae00e6536a2dd54b64b39e9a39548870cf835745 or later; Android devices should receive the corresponding vendor patches listed for releases 10-13.

How to confirm the fix worked

Confirm kernel source contains the added F2FS_INLINE_DATA sanity check in fs/f2fs/gc.c or fs/f2fs/inline.c; verify running kernel version is newer than the vulnerable commit and test with syzbot-style reproducer.

Typical attack path

  1. Craft malicious f2fs image with inconsistent inline_data inode
  2. Convince target to mount the image (local or via loopback)
  3. Trigger background GC or writeback workload
  4. Kernel hits BUG in f2fs_write_inline_data and panics

How to detect it

Search kernel logs for 'kernel BUG at fs/f2fs/inline.c:258' and the call trace containing f2fs_write_inline_data, f2fs_write_single_data_page, and wb_workfn; inspect mounts of f2fs volumes preceding the crash.

  • kernel BUG at fs/f2fs/inline.c:258
  • f2fs_write_inline_data+0x781/0x790
  • RIP: 0010:f2fs_write_inline_data

What your security team should do

  • Apply kernel updates containing ae00e6536a2dd54b64b39e9a39548870cf835745 immediately on all f2fs deployments
  • Disable f2fs on systems where feasible until patched
  • Monitor for kernel BUG reports referencing f2fs_write_inline_data
  • Restrict untrusted f2fs image mounting via mount options or SELinux/AppArmor

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inline.c:258! CPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc6-syzkaller-00012-g9e4bc4bcae01 #0 RIP: 0010:f2fs_write_inline_data+0x781/0x790 fs/f2fs/inline.c:258 Call Trace: f2fs_write_single_data_page+0xb65/0x1d60 fs/f2fs/data.c:2834 f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3288 [inline] f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3315 do_writepages+0x35b/0x870 mm/page-writeback.c:2612 __writeback_single_inode+0x165/0x10b0 fs/fs-writeback.c:1650 writeback_sb_inodes+0x905/0x1260 fs/fs-writeback.c:1941 wb_writeback+0x457/0xce0 fs/fs-writeback.c:2117 wb_do_writeback fs/fs-writeback.c:2264 [inline] wb_workfn+0x410/0x1090 fs/fs-writeback.c:2304 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa12/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f2/0x390 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The root cause is: inline_data inode can be fuzzed, so that there may be valid blkaddr in its direct node, once f2fs triggers background GC to migrate the block, it will hit f2fs_bug_on() during dirty page writeback. Let's add sanity check on F2FS_INLINE_DATA flag in inode during GC, so that, it can forbid migrating inline_data inode's data block for fixing.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.10.6-1
Linux Kernel 3.8.0 6.6.47
Mageia:9 kernel 0 6.6.50-1.mga9
Mageia:9 kernel-linus 0 6.6.50-1.mga9
Mageia:9 kmod-virtualbox 0 7.0.20-53.mga9
Mageia:9 kmod-xtables-addons 0 3.24-61.mga9
Ubuntu:14.04:LTS linux 0 3.11.0-12.19
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-202.222
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1136.146
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1073.79~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1142.149
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1078.87~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1096.103
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1140.149
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1072.80~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-127.137~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1083.88
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1066.69~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1071.77~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1045.46
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1124.132
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-127.137~20.04.1
Ubuntu:20.04:LTS linux-nvidia-tegra-5.15 0 5.15.0-1032.32~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1135.144
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1071.77~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1120.132
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1069.73~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1055.59
Ubuntu:22.04:LTS linux 0 5.15.0-127.137
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1073.79
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1020.22~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1078.87
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1020.23~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1072.80
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1070.76
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1056.63
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-50.51~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1066.69
Ubuntu:22.04:LTS linux-ibm-6.8 0 6.8.0-1017.17~22.04.1
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1071.77
Ubuntu:22.04:LTS linux-kvm 0 5.15.0-1070.75
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-127.137
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1068.69
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-nvidia-tegra 0 5.15.0-1032.32
Ubuntu:22.04:LTS linux-nvidia-tegra-igx 0 5.15.0-1020.20
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 5.15.0-1071.77
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1017.18~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 5.15.0-1066.69
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1039.43
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 6.8.0-50.51
Ubuntu:24.04:LTS linux-aws 0 6.8.0-1020.22
Ubuntu:24.04:LTS linux-azure 0 6.8.0-1020.23
Ubuntu:24.04:LTS linux-gcp 0 6.8.0-1019.21
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1015.19
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1002.4
Ubuntu:24.04:LTS linux-ibm 0 6.8.0-1017.17
Ubuntu:24.04:LTS linux-lowlatency 0 6.8.0-50.51.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1019.21
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1019.21.1
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1018.18
Ubuntu:24.04:LTS linux-oracle 0 6.8.0-1017.18
Ubuntu:24.04:LTS linux-raspi 0 6.8.0-1016.18
Ubuntu:24.04:LTS linux-raspi-realtime 0 No fix
Ubuntu:24.04:LTS linux-realtime 0 No fix
Ubuntu:24.04:LTS linux-riscv 0 6.8.0-50.51.1
Ubuntu:24.04:LTS linux-xilinx 0 6.8.0-1017.18
Ubuntu:24.10 linux 0 6.11.0-7.7
Ubuntu:24.10 linux-aws 0 6.11.0-1002.2
Ubuntu:24.10 linux-azure 0 6.11.0-1003.3
Ubuntu:24.10 linux-gcp 0 6.11.0-1001.1
Ubuntu:24.10 linux-lowlatency 0 6.11.0-1002.2
Ubuntu:24.10 linux-oracle 0 6.11.0-1004.4
Ubuntu:24.10 linux-raspi 0 6.11.0-1003.3
Ubuntu:24.10 linux-realtime 0 6.11.0-1001.1
Ubuntu:24.10 linux-riscv 0 6.11.0-8.8.1
Ubuntu:Nvidia-BlueField:22.04:LTS linux-bluefield 0 5.15.0-1057.59
Ubuntu:Pro:14.04:LTS linux-aws 0 4.4.0-1138.144
Ubuntu:Pro:14.04:LTS linux-azure 0 4.15.0-1183.198~14.04.1
Ubuntu:Pro:14.04:LTS linux-lts-xenial 0 4.4.0-261.295~14.04.1
Ubuntu:Pro:16.04:LTS linux 0 4.4.0-261.295
Ubuntu:Pro:16.04:LTS linux-aws 0 4.4.0-1176.191
Ubuntu:Pro:16.04:LTS linux-aws-hwe 0 4.15.0-1175.188~16.04.1
Ubuntu:Pro:16.04:LTS linux-azure 0 4.15.0-1183.198~16.04.1
Ubuntu:Pro:16.04:LTS linux-gcp 0 4.15.0-1168.185~16.04.1
Ubuntu:Pro:16.04:LTS linux-hwe 0 4.15.0-231.243~16.04.1
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:16.04:LTS linux-kvm 0 4.4.0-1139.149
Ubuntu:Pro:16.04:LTS linux-oracle 0 4.15.0-1137.148~16.04.1
Ubuntu:Pro:18.04:LTS linux 0 4.15.0-231.243
Ubuntu:Pro:18.04:LTS linux-aws 0 4.15.0-1175.188
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.4 0 5.4.0-1136.146~18.04.1
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-4.15 0 4.15.0-1183.198
Ubuntu:Pro:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-5.4 0 5.4.0-1142.149~18.04.1
Ubuntu:Pro:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-4.15 0 4.15.0-1168.185
Ubuntu:Pro:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-5.4 0 5.4.0-1140.149~18.04.1
Ubuntu:Pro:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe-5.4 0 5.4.0-202.222~18.04.1
Ubuntu:Pro:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-ibm-5.4 0 5.4.0-1083.88~18.04.1
Ubuntu:Pro:18.04:LTS linux-kvm 0 4.15.0-1158.163
Ubuntu:Pro:18.04:LTS linux-oem 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle 0 4.15.0-1137.148

Related vulnerabilities