CVE-2024-47689— f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5< 649ec8b30df113042588bd3d3cd4e98bcb1091e0 | affected |
b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5< de43021c72993877a8f86f9fddfa0687609da5a4 | affected | ||
b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5< 1f63f405c1a1a64b9c310388aad7055fb86b245c | affected | ||
b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5< 930c6ab93492c4b15436524e704950b364b2930c | affected | ||
ed1d478bf838820201f3fb67a1748fdf15954ea4 | affected | ||
6.4.4< 6.5 | affected | ||
6.5 | affected | ||
< 6.5 | unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-47689
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error() syzbot reports a f2fs bug as below: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 58 at kernel/rcu/sync.c:177 rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177 CPU: 1 UID: 0 PID: 58 Comm: kworker/1:2 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0 Workqueue: events destroy_super_work RIP: 0010:rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177 Call Trace: percpu_free_rwsem+0x41/0x80 kernel/locking/percpu-rwsem.c:42 destroy_super_work+0xec/0x130 fs/super.c:282 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 As Christian Brauner pointed out [1]: the root cause is f2fs sets SB_RDONLY flag in internal function, rather than setting the flag covered w/ sb->s_umount semaphore via remount procedure, then below race condition causes this bug: - freeze_super() - sb_wait_write(sb, SB_FREEZE_WRITE) - sb_wait_write(sb, SB_FREEZE_PAGEFAULT) - sb_wait_write(sb, SB_FREEZE_FS) - f2fs_handle_critical_error - sb->s_flags |= SB_RDONLY - thaw_super - thaw_super_locked - sb_rdonly() is true, so it skips sb_freeze_unlock(sb, SB_FREEZE_FS) - deactivate_locked_super Since f2fs has almost the same logic as ext4 [2] when handling critical error in filesystem if it mounts w/ errors=remount-ro option: - set CP_ERROR_FLAG flag which indicates filesystem is stopped - record errors to superblock - set SB_RDONLY falg Once we set CP_ERROR_FLAG flag, all writable interfaces can detect the flag and stop any further updates on filesystem. So, it is safe to not set SB_RDONLY flag, let's remove the logic and keep in line w/ ext4 [3]. [1] https://lore.kernel.org/all/20240729-himbeeren-funknetz-96e62f9c7aee@brauner [2] https://lore.kernel.org/all/20240729132721.hxih6ehigadqf7wx@quack3 [3] https://lore.kernel.org/linux-ext4/20240805201241.27286-1-jack@suse.cz
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于f2fs文件系统中对SB_RDONLY标志的错误设置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-47689
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47689
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total
| CVE-2024-50043 | 9.8 CRITICAL | nfsd: fix possible badness in FREE_STATEID |
| CVE-2022-48985 | 9.8 CRITICAL | net: mana: Fix race on per-CQ variable napi work_done |
| CVE-2024-47695 | 9.8 CRITICAL | RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds |
| CVE-2024-50033 | 9.8 CRITICAL | slip: make slhc_remember() more robust against malicious packets |
| CVE-2024-49855 | 9.8 CRITICAL | nbd: fix race between timeout and normal completion |
| CVE-2024-50047 | 9.8 CRITICAL | smb: client: fix UAF in async decryption |
| CVE-2022-49003 | 9.8 CRITICAL | nvme: fix SRCU protection of nvme_ns_head list |
| CVE-2024-50046 | 9.8 CRITICAL | NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() |
| CVE-2024-49996 | 9.4 CRITICAL | cifs: Fix buffer overflow when parsing NFS reparse points |
| CVE-2024-47678 | 9.4 CRITICAL | icmp: change the order of rate limits |
| CVE-2022-49017 | 8.8 HIGH | tipc: re-fetch skb cb after tipc_msg_validate |
| CVE-2024-50029 | 8.8 HIGH | Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync |
| CVE-2024-50041 | 8.8 HIGH | i40e: Fix macvlan leak by synchronizing access to mac_filter_hash |
| CVE-2024-49939 | 8.8 HIGH | wifi: rtw89: avoid to add interface to list twice when SER |
| CVE-2022-48960 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hix5hd2_rx() |
| CVE-2022-48962 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hisi_femac_rx() |
| CVE-2022-48964 | 8.8 HIGH | ravb: Fix potential use-after-free in ravb_rx_gbeth() |
| CVE-2022-49015 | 8.8 HIGH | net: hsr: Fix potential use-after-free |
| CVE-2022-48967 | 8.8 HIGH | NFC: nci: Bounds check struct nfc_target arrays |
| CVE-2024-49930 | 8.8 HIGH | wifi: ath11k: fix array out-of-bound access in SoC stats |
Showing top 20 of 372 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2024-47689
No comments yet