CVE-2024-42297: f2fs: fix to don't dirty inode for readonly filesystem
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to don't dirty inode for readonly filesystem
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fsevictinode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 disposelist fs/inode.c:697 [inline] evictinodes+0x5f8/0x690 fs/inode.c:747 genericshutdownsuper+0x9d/0x2c0 fs/super.c:675 killblocksuper+0x44/0x90 fs/super.c:1667 killf2fssuper+0x303/0x3b0 fs/f2fs/super.c:4894 deactivatelockedsuper+0xc1/0x130 fs/super.c:484 cleanupmnt+0x426/0x4c0 fs/namespace.c:1256 taskworkrun+0x24a/0x300 kernel/taskwork.c:180 ptracenotify+0x2cd/0x380 kernel/signal.c:2399 ptracereportsyscall include/linux/ptrace.h:411 [inline] ptracereportsyscallexit include/linux/ptrace.h:473 [inline] syscallexitwork kernel/entry/common.c:251 [inline] syscallexittousermodeprepare kernel/entry/common.c:278 [inline] syscallexittousermodework kernel/entry/common.c:283 [inline] syscallexittousermode+0x15c/0x280 kernel/entry/common.c:296 dosyscall64+0x50/0x110 arch/x86/entry/common.c:88 entrySYSCALL64afterhwframe+0x63/0x6b
The root cause is: - dosysopen - f2fslookup - f2fsfindentry - f2fsidepthwrite - f2fsmarkinodedirtysync - f2fsdirtyinode - setinodeflag(inode, FIDIRTYINODE)
- umount - killf2fssuper - killblocksuper - genericshutdownsuper - syncfilesystem : sb is readonly, skip syncfilesystem() - evictinodes - iput - f2fsevictinode - f2fsbugon(sbi, isinodeflagset(inode, FIDIRTYINODE)) : trigger kernel panic
When we try to repair icurrentdepth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fsevictinode().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42297?
CVE-2024-42297 is considered a high severity vulnerability due to its impact on the integrity of the Linux kernel's file system operations.
How do I fix CVE-2024-42297?
To fix CVE-2024-42297, update the Linux Kernel to a version that is not vulnerable, specifically to any version higher than 6.1.103 or between 6.2 and 6.6.44.
Which Linux Kernel versions are affected by CVE-2024-42297?
CVE-2024-42297 affects Linux Kernel versions between 5.10.223-1 and 6.1.103, and includes versions between 6.2 and 6.6.44 as well as 6.7 to 6.10.3.
What is the nature of CVE-2024-42297?
CVE-2024-42297 is a kernel vulnerability that involves improper handling of inodes in read-only filesystems.
Is there a specific patch for CVE-2024-42297?
Yes, specific packages such as linux-6.1 version 6.1.119-1~deb11u1 are recommended to address the issues related to CVE-2024-42297.