CVE-2024-33847: f2fs: compress: don't allow unaligned truncation on released compress inode
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: don't allow unaligned truncation on released compress inode
f2fs image may be corrupted after below testcase: - mkfs.f2fs -O extraattr,compression -f /dev/vdb - mount /dev/vdb /mnt/f2fs - touch /mnt/f2fs/file - f2fsio setflags compression /mnt/f2fs/file - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4 - f2fsio releasecblocks /mnt/f2fs/file - truncate -s 8192 /mnt/f2fs/file - umount /mnt/f2fs - fsck.f2fs /dev/vdb
[ASSERT] (fsckchkinodeblk:1256) --> ino: 0x5 has iblocks: 0x00000002, but has 0x3 blocks [FSCK] validblockcount matching with CP [Fail] [0x4, 0x5] [FSCK] other corrupted bugs [Fail]
The reason is: partial truncation assume compressed inode has reserved blocks, after partial truncation, valid block count may change w/o .iblocks and .totalvalidblockcount update, result in corruption.
This patch only allow cluster size aligned truncation on released compress inode for fixing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Configuration
Apply the kernel fix for f2fs compression so truncation on a released compressed inode is only permitted when the truncation size is aligned to the filesystem cluster size (prevents corruption observed as fsck ASSERT: fsck_chk_inode_blk:1256 valid_block_count/i_blocks mismatch).
Linux kernel f2fs (compression feature) truncate behavior on released compressed inodes = Allow only cluster-size aligned truncation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33847?
CVE-2024-33847 is categorized with a moderate severity due to potential data corruption risks in the f2fs filesystem.
How do I fix CVE-2024-33847?
To fix CVE-2024-33847, you should upgrade to the patched versions of the Linux kernel: 5.10.223-1, 5.10.234-1, 6.1.123-1, 6.1.128-1, or 6.12.17-1.
What impact does CVE-2024-33847 have on my system?
CVE-2024-33847 can lead to data corruption on f2fs images when unaligned truncation occurs on released compressed inodes.
Which systems are affected by CVE-2024-33847?
CVE-2024-33847 affects Linux systems that utilize the f2fs filesystem with compression enabled.
Is there a workaround for CVE-2024-33847?
Currently, the recommended action for CVE-2024-33847 is to apply the necessary kernel updates rather than seeking workarounds.