CVE-2024-56692

What it actually does

Missing sanity check on node blkaddr from NAT entry in f2fs truncate_node() allows corrupted blkaddr values from a malformed image to reach f2fs_invalidate_blocks() and trigger a kernel BUG/panic.

Why it matters to the business

Systems using the f2fs filesystem on Linux can experience sudden kernel panics and crashes when processing untrusted or corrupted f2fs images, leading to denial of service and potential data loss during file operations.

How an attack unfolds

An attacker supplies a fuzzed f2fs filesystem image containing a corrupted node address in the NAT; when the kernel performs inode eviction or file creation that calls f2fs_remove_inode_page and truncate_node, the invalid blkaddr is passed to f2fs_invalidate_blocks causing the panic. No public in-the-wild exploitation is recorded for this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 27d6e7eff07f8cce8e83b162d8f21a07458c860d or later; rebuild and reboot affected systems. Disable f2fs mounts from untrusted sources until patched.

How to confirm the fix worked

Confirm the presence of commit 27d6e7eff07f8cce8e83b162d8f21a07458c860d in the kernel source; attempt to reproduce the original syzbot reproducer on an unpatched kernel to verify the panic is eliminated after the update.

Typical attack path

1. Mount or access a maliciously crafted f2fs image
2. Trigger inode eviction or open/create operations that invoke f2fs_evict_inode
3. Reach f2fs_remove_inode_page and truncate_node with a corrupted NAT blkaddr
4. Execute f2fs_invalidate_blocks on the invalid address and trigger kernel BUG

How to detect it

Review kernel logs for the exact BUG message at fs/f2fs/segment.c:2534 during f2fs operations; correlate with file open or creation syscalls on f2fs mounts. No post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems that mount f2fs volumes
• Restrict mounting of f2fs images from untrusted or external sources until patches are applied
• Monitor for future stable kernel releases that backport the fix