CVE-2024-49887

What it actually does

Fault injection of no free segment condition in f2fs triggers an unhandled kernel BUG panic in get_new_segment during new segment allocation instead of graceful error handling.

Why it matters to the business

Systems using the f2fs filesystem can experience unexpected kernel crashes leading to downtime and potential data unavailability until reboot.

How an attack unfolds

An attacker with local access triggers the no-free-segment fault injection path in f2fs (via syzkaller-style or similar mechanisms) while performing fallocate or pinning operations that invoke __allocate_new_segment, causing the kernel to panic at the assertion in get_new_segment.

How to fix it

Upgrade the Linux kernel to a version containing commit 9f6e7a0512a57387d36f5e9e9635d6668cac13dd. For Rocky Linux 8 packages, apply the listed fixed versions of libiscsi, netcf, and sgabios modules that incorporate the corrected f2fs code.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or package updates; re-test fault injection scenarios to confirm no panic occurs and the filesystem logs a non-fatal error instead.

Typical attack path

1. Obtain local code execution on a system with f2fs mounted
2. Inject no-free-segment fault into get_new_segment
3. Invoke f2fs_allocate_pinning_section or f2fs_expand_inode_data via fallocate or similar ioctl
4. Trigger kernel BUG and system panic

How to detect it

Search kernel logs and dmesg for strings indicating f2fs fault injection followed by a BUG at fs/f2fs/segment.c:2748 or "Stopped filesystem due to reason: 7".

• kernel BUG at fs/f2fs/segment.c:2748
• F2FS-fs.*Stopped filesystem due to reason: 7
• get_new_segment+0x1f61/0x1f70 fs/f2fs/segment.c:2836

What your security team should do

• Prioritize kernel updates on all systems using f2fs
• Review and restrict local user access to fallocate and f2fs-specific ioctls where possible
• Enable kernel panic logging and monitoring for f2fs segment.c errors