{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-42273", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-42273" ], "published": "2024-08-17T08:54:50Z", "summary": "f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid\n\nmkdir /mnt/test/comp\nf2fs_io setflags compression /mnt/test/comp\ndd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1\ntruncate --size 13 /mnt/test/comp/testfile\n\nIn the above scenario, we can get a BUG_ON.\n kernel BUG at fs/f2fs/segment.c:3589!\n Call Trace:\n do_write_page+0x78/0x390 [f2fs]\n f2fs_outplace_write_data+0x62/0xb0 [f2fs]\n f2fs_do_write_data_page+0x275/0x740 [f2fs]\n f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs]\n f2fs_write_multi_pages+0x1e5/0xae0 [f2fs]\n f2fs_write_cache_pages+0xab1/0xc60 [f2fs]\n f2fs_write_data_pages+0x2d8/0x330 [f2fs]\n do_writepages+0xcf/0x270\n __writeback_single_inode+0x44/0x350\n writeback_sb_inodes+0x242/0x530\n __writeback_inodes_wb+0x54/0xf0\n wb_writeback+0x192/0x310\n wb_workfn+0x30d/0x400\n\nThe reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the\npage was set the gcing flag by set_cluster_dirty().", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.6.20-1+rpt1", "1:6.6.28-1+rpt1", "1:6.6.31-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.6.20+rpt-rpi-2712", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v6", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7l", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v8", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-2712", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v6", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7l", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v8", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-2712", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v6", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7l", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v8", "binary_version": "1:6.6.31-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.6.20-1+rpt1": { "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668", "upstream_version": "6.6.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.45" }, "1:6.6.28-1+rpt1": { "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e", "upstream_version": "6.6.28", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.45" }, "1:6.6.31-1+rpt1": { "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424", "upstream_version": "6.6.31", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.45" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42273" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - Triggered entirely through local filesystem syscalls (mkdir, FS_IOC_SETFLAGS ioctl, write, truncate) on an already-mounted f2fs volume. No network or remote peer is involved.\nAC:L - The upstream reproducer is a deterministic four-command sequence fully under attacker control with no race window and no dependence on memory layout; the attacker dirties the compressed cluster and normal background writeback reliably reaches the faulty path.\nPR:L - Requires only an unprivileged local account with write access to an f2fs mount (e.g. an ordinary app sandbox on Android /data); setting the compression flag on one's own directory needs no capability.\nUI:N - No victim action is needed \u2014 the filesystem is already mounted in the target scenario and the fault fires asynchronously in the kernel writeback worker after the attacker's truncate.\nS:U - The corruption and crash are confined to the kernel's own memory and the f2fs metadata it manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In production builds without CONFIG_F2FS_CHECK_FS the code dereferences sentries[0xFFFFFFFF], a wild out-of-bounds read roughly 171 GB past the array, and the value read is then used to index dirty_segmap[] far beyond its 8 entries, producing a chained unbounded read of kernel memory.\nI:H - The out-of-bounds seg_entry supplies an attacker-uncontrolled segment type and mtime to get_atssr_segment()/f2fs_get_victim(), which scans an out-of-bounds pointer as a dirty bitmap and picks the segment that data blocks are allocated into, corrupting SIT/segment metadata \u2014 the kernel itself sets SBI_NEED_FSCK on this path.\nA:H - With CONFIG_F2FS_CHECK_FS this is an outright BUG_ON panic, and without it the wild dereference oopses; either way it happens in the shared writeback kworker while holding curseg_lock, curseg_mutex and sentry_lock, hanging the filesystem system-wide." } } }