CVE-2024-47680

What it actually does

Missing discard support check for conventional zones on zoned block devices causes __blkdev_issue_discard to return NULL bio, triggering f2fs_bug_on in __submit_discard_cmd during umount.

Why it matters to the business

Linux systems using f2fs on certain zoned storage may crash on unmount, leading to downtime, data access loss, and operational disruption in storage-heavy environments with moderate ecosystem prevalence.

How an attack unfolds

Local attacker sets up f2fs on a zoned null_blk device with conventional zones lacking discard, performs writes, then unmounts to hit the NULL dereference. Threat actors from 2024 espionage and financial campaigns or those targeting Linux kernel resource and bounds issues may leverage similar paths for denial of service.

How to fix it

Apply kernel patch that checks bdev support for discard before __submit_discard_cmd on conventional zones. Upgrade affected packages to fixed versions including actionpack (RubyGems) 6.0.4.1 and 6.1.4.1 where applicable.

How to confirm the fix worked

Verify kernel source contains discard support check prior to __blkdev_issue_discard for conventional zones; test unmount sequence on zoned null_blk device with conventional zones.

Typical attack path

1. Locate or create zoned block device with conventional zones without discard support
2. Format filesystem with f2fs using mkfs.f2fs -m
3. Mount and write data via repeated dd operations
4. Unmount to invoke discard path
5. Trigger f2fs_bug_on via NULL bio

How to detect it

Review kernel logs for f2fs_bug_on traces during umount on zoned devices; inspect dmesg and audit logs for discard-related NULL pointer warnings or BUG entries tied to conventional zones.

What your security team should do

• Prioritize kernel updates on systems with f2fs and zoned storage before CISA deadlines if applicable
• Audit for zoned block device usage in storage configurations
• Monitor EPSS trend stability and threat actor activity around Linux kernel vulnerabilities
• Test unmount behavior in lab environments matching the reported null_blk setup