{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47726", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.957Z", "datePublished": "2024-10-21T12:13:59.615Z", "dateUpdated": "2026-08-05T11:39:45.356Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:45.356Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to wait dio completion\n\nIt should wait all existing dio write IOs before block removal,\notherwise, previous direct write IO may overwrite data in the\nblock which may be reused by other inode." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - f2fs is a local filesystem; the bug is reached through ordinary syscalls (`pwrite`/`io_submit` with O_DIRECT plus `ftruncate`/`truncate`/`open(O_TRUNC)`/`fallocate`) on a locally mounted volume. No network protocol handler is involved.\nAC:L - The attacker owns both sides of the race — it submits the async direct-I/O write and then issues the truncate/punch-hole itself — and can additionally force the checkpoint (`syncfs`) and block reallocation (file-creation spray) needed to land the stale write on another inode. The attempt is freely repeatable and the window is large on the slow eMMC/SD storage typical of f2fs deployments.\nPR:L - Only an unprivileged local account is required, operating on a file it owns; no capability, no user namespace trick, and no mount privilege are needed since /data or the rootfs on Android and embedded systems is already f2fs.\nUI:N - The attacker performs every step itself — direct write, truncate/fallocate, sync, reallocation spray — with no action by any other user or administrator.\nS:U - The corruption stays within the kernel/filesystem security authority that also contains the vulnerable code; no hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - `inode_dio_wait()` also drains reads, so an in-flight direct read over freed-and-reassigned blocks returns another inode's data to the attacker's buffer; more severely, a stale write landing on an f2fs node block lets the attacker forge block pointers and inode ownership, yielding read access to arbitrary other files' contents on the volume.\nI:H - Attacker-controlled data is written into blocks already reallocated to a different inode or to f2fs node/inode metadata, silently overwriting other users' or system files and enabling forged i_uid/i_mode and block mappings — an on-disk privilege-escalation primitive.\nA:H - Corrupted node/metadata blocks trip f2fs sanity checks, leading to `f2fs_bug_on()`/oops, `f2fs_handle_error()` with `SBI_NEED_FSCK`, or a shut-down (cp_error, all operations returning -EIO) filesystem and permanent data loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/file.c" ], "versions": [ { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "7be13b73409b553d9d9a6cbb042b4d19e2631cc7", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "3aa5254d80969cb576601fb9fec7a188cc8dc169", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "f81302decd64245bb1bd154ecae0f65a9ee21f04", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "c2a7fc514637f640ff55c3f3e3ed879970814a3f", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "e3db757ff9b7101ae68650ac5f6dd5743b68164e", "status": "affected", "versionType": "git" }, { "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4", "lessThan": "96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/file.c" ], "versions": [ { "version": "3.8", "status": "affected" }, { "version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.70" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7be13b73409b553d9d9a6cbb042b4d19e2631cc7" }, { "url": "https://git.kernel.org/stable/c/3aa5254d80969cb576601fb9fec7a188cc8dc169" }, { "url": "https://git.kernel.org/stable/c/f81302decd64245bb1bd154ecae0f65a9ee21f04" }, { "url": "https://git.kernel.org/stable/c/c2a7fc514637f640ff55c3f3e3ed879970814a3f" }, { "url": "https://git.kernel.org/stable/c/e3db757ff9b7101ae68650ac5f6dd5743b68164e" }, { "url": "https://git.kernel.org/stable/c/96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d" } ], "title": "f2fs: fix to wait dio completion", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47726", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T13:01:14.779323Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:16.612Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:31:22.106Z" } } ] } }