{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-27035", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.211Z", "datePublished": "2024-05-01T12:53:43.155Z", "dateUpdated": "2026-08-05T11:29:09.926Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:09.926Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to guarantee persisting compressed blocks by CP\n\nIf data block in compressed cluster is not persisted with metadata\nduring checkpoint, after SPOR, the data may be corrupted, let's\nguarantee to write compressed page by checkpoint." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached by writing to a file on a locally mounted f2fs volume via ordinary write/fsync/sync syscalls and an FS_IOC_SETFLAGS ioctl; no network protocol handler processes attacker data on this path.\nAC:L - The attacker fully controls both sides of the window — issuing compressed-cluster writeback and forcing a concurrent checkpoint — and the checkpoint deterministically fails to wait for or even submit the compressed blocks every time, so no condition of the exploit itself is outside attacker influence.\nPR:L - Enabling compression requires only inode_owner_or_capable() on one's own empty file (fs/f2fs/file.c:1906), and on compress_extension-mounted volumes even that is unnecessary; any unprivileged local user with write access to the f2fs volume can trigger it.\nUI:N - Writeback, checkpointing, and the missing CP wait all occur automatically in kernel context once the attacker writes and syncs; no victim action is required.\nS:U - The corruption is confined to the f2fs filesystem managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - Blocks marked valid by the committed checkpoint were never written, so reads return the prior on-disk content of freshly allocated LFS blocks — potentially another user's deleted file data — though the clen validation and decompressor bounds checks limit how much coherent data is recoverable.\nI:H - Committed, fsync-acknowledged user file data is silently replaced with stale block content after power loss, and the resulting f2fs metadata/data mismatch is an unbounded corruption of arbitrary files on the volume.\nA:H - Affected clusters permanently return -EFSCORRUPTED/-EIO, the superblock is flagged SBI_NEED_FSCK with ERROR_FAIL_DECOMPRESSION recorded, forcing a full fsck (and on Android, boot-time repair or data loss) — a durable loss of availability for the stored data." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/compress.c", "fs/f2fs/data.c", "fs/f2fs/f2fs.h" ], "versions": [ { "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3", "lessThan": "e54cce8137258a550b49cae45d09e024821fb28d", "status": "affected", "versionType": "git" }, { "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3", "lessThan": "82704e598d7b33c7e45526e34d3c585426319bed", "status": "affected", "versionType": "git" }, { "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3", "lessThan": "c3311694b9bcced233548574d414c91d39214684", "status": "affected", "versionType": "git" }, { "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3", "lessThan": "57e8b17d0522c8f4daf0c4d9969b4d7358033532", "status": "affected", "versionType": "git" }, { "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3", "lessThan": "8a430dd49e9cb021372b0ad91e60aeef9c6ced00", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/compress.c", "fs/f2fs/data.c", "fs/f2fs/f2fs.h" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.83", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.7.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.8.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e54cce8137258a550b49cae45d09e024821fb28d" }, { "url": "https://git.kernel.org/stable/c/82704e598d7b33c7e45526e34d3c585426319bed" }, { "url": "https://git.kernel.org/stable/c/c3311694b9bcced233548574d414c91d39214684" }, { "url": "https://git.kernel.org/stable/c/57e8b17d0522c8f4daf0c4d9969b4d7358033532" }, { "url": "https://git.kernel.org/stable/c/8a430dd49e9cb021372b0ad91e60aeef9c6ced00" } ], "title": "f2fs: compress: fix to guarantee persisting compressed blocks by CP", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-17T17:40:14.613391Z", "id": "CVE-2024-27035", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:45:34.458Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.950Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/e54cce8137258a550b49cae45d09e024821fb28d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/82704e598d7b33c7e45526e34d3c585426319bed", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c3311694b9bcced233548574d414c91d39214684", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/57e8b17d0522c8f4daf0c4d9969b4d7358033532", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8a430dd49e9cb021372b0ad91e60aeef9c6ced00", "tags": [ "x_transferred" ] } ] } ] } }