CVE-2024-42296: f2fs: fix return value of f2fs_convert_inline_inode()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix return value of f2fsconvertinlineinode()
If device is readonly, make f2fsconvertinlineinode() return EROFS instead of zero, otherwise it may trigger panic during writeback of inline inode's dirty page as below:
f2fswritesingledatapage+0xbb6/0x1e90 fs/f2fs/data.c:2888 f2fswritecachepages fs/f2fs/data.c:3187 [inline] f2fswritedatapages fs/f2fs/data.c:3342 [inline] f2fswritedatapages+0x1efe/0x3a90 fs/f2fs/data.c:3369 dowritepages+0x359/0x870 mm/page-writeback.c:2634 filemapfdatawritewbc+0x125/0x180 mm/filemap.c:397 filemapfdatawriterange mm/filemap.c:430 [inline] filewriteandwaitrange+0x1aa/0x290 mm/filemap.c:788 f2fsdosyncfile+0x68a/0x1ae0 fs/f2fs/file.c:276 genericwritesync include/linux/fs.h:2806 [inline] f2fsfilewriteiter+0x7bd/0x24e0 fs/f2fs/file.c:4977 callwriteiter include/linux/fs.h:2114 [inline] newsyncwrite fs/readwrite.c:497 [inline] vfswrite+0xa72/0xc90 fs/readwrite.c:590 ksyswrite+0x1a0/0x2c0 fs/readwrite.c:643 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf5/0x240 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Modify f2fs_convert_inline_inode() so that if the underlying device is readonly, it returns EROFS rather than zero to prevent panic during writeback of inline inode dirty pages.
Linux kernel f2fs f2fs_convert_inline_inode() return value when device is readonly = EROFS (instead of zero)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42296?
CVE-2024-42296 has a severity rating that suggests it can lead to system instability under certain conditions.
How do I fix CVE-2024-42296?
To mitigate CVE-2024-42296, upgrade to the remedied versions of the Linux kernel, specifically 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of Linux are affected by CVE-2024-42296?
CVE-2024-42296 affects Linux kernel versions up to 5.10.226-1, depending on the specific Debian package.
What does CVE-2024-42296 impact in the Linux kernel?
CVE-2024-42296 impacts the handling of inline inodes in the f2fs file system, particularly when devices are in read-only mode.
Is there a risk of data loss with CVE-2024-42296?
Yes, if not addressed, CVE-2024-42296 may trigger a panic during writeback, potentially leading to data loss.