CVE-2024-47690

What it actually does

Race condition in f2fs_lookup permits online repair of corrupted directories to generate dirty inodes while racing with readonly remount; checkpoint skips flushing in readonly mode, leaving dirty inodes that trigger BUG/panic in f2fs_evict_inode.

Why it matters to the business

Causes kernel panics and filesystem instability on Linux systems using f2fs, resulting in unplanned downtime, data recovery efforts, and operational disruption; widespread Linux kernel usage heightens exposure across servers and devices.

How an attack unfolds

Attacker triggers directory lookups on a corrupted f2fs filesystem to invoke online repair, then races the operation against a readonly remount to leave dirty inodes; this leads to panic on subsequent evict and checkpoint. Context from 2024 espionage and financially motivated campaigns targeting Linux kernel flaws noted in exploitation reports.

How to fix it

Remove online repair logic from f2fs_lookup() and rely on fsck.f2fs for corruption handling; apply upstream kernel patches resolving the race; upgrade to fixed kernel releases containing the resolution.

How to confirm the fix worked

Inspect f2fs_lookup source for absence of online repair paths, reproduce remount races with induced corruption in test environments, and confirm no dirty inodes persist post-remount in readonly state.

Typical attack path

1. Create or access corrupted directory on f2fs volume
2. Trigger f2fs_lookup to initiate online repair
3. Race with concurrent readonly remount
4. Force checkpoint skip leaving dirty inode
5. Evict inode to hit BUG at fs/f2fs/inode.c:896

How to detect it

Search kernel logs and dmesg for BUG at fs/f2fs/inode.c:896, f2fs_evict_inode traces, kill_f2fs_super calls, and sequences involving generic_shutdown_super with concurrent remounts or ptrace activity.

• kernel BUG at fs/f2fs/inode.c:896
• f2fs_evict_inode+0x1598/0x15c0
• kill_f2fs_super+0x344/0x690
• evict_inodes+0x5f9/0x690

What your security team should do

• Apply kernel updates addressing f2fs race immediately due to Linux ecosystem prevalence
• Schedule fsck.f2fs scans on all f2fs volumes
• Monitor kernel logs for f2fs_evict_inode panics
• Restrict untrusted access to f2fs mounts pending patches