CVE-2024-49887: f2fs: fix to don't panic system for no free segment fault injection
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to don't panic system for no free segment fault injection
f2fs: fix to don't panic system for no free segment fault injection
syzbot reports a f2fs bug as below:
F2FS-fs (loop0): inject no free segment in getnewsegment of allocatenewsegment+0x1ce/0x940 fs/f2fs/segment.c:3167 F2FS-fs (loop0): Stopped filesystem due to reason: 7 ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2748! CPU: 0 UID: 0 PID: 5109 Comm: syz-executor304 Not tainted 6.11.0-rc6-syzkaller-00363-g89f5e14d05b4 #0 RIP: 0010:getnewsegment fs/f2fs/segment.c:2748 [inline] RIP: 0010:newcurseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836 Call Trace: allocatenewsegment+0x1ce/0x940 fs/f2fs/segment.c:3167 f2fsallocatenewsection fs/f2fs/segment.c:3181 [inline] f2fsallocatepinningsection+0xfa/0x4e0 fs/f2fs/segment.c:3195 f2fsexpandinodedata+0x5d6/0xbb0 fs/f2fs/file.c:1799 f2fsfallocate+0x448/0x960 fs/f2fs/file.c:1903 vfsfallocate+0x553/0x6c0 fs/open.c:334 dovfsioctl+0x2592/0x2e50 fs/ioctl.c:886 dosysioctl fs/ioctl.c:905 [inline] sesysioctl+0x81/0x170 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0010:getnewsegment fs/f2fs/segment.c:2748 [inline] RIP: 0010:newcurseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836
The root cause is when we inject no free segment fault into f2fs, we should not panic system, fix it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49887?
CVE-2024-49887 is classified as a medium severity vulnerability that could potentially cause system instability under certain conditions.
How do I fix CVE-2024-49887?
To resolve CVE-2024-49887, ensure that your Linux kernel is updated to version 6.10.14 or later, or to version 6.11.3 or later.
What types of systems are affected by CVE-2024-49887?
CVE-2024-49887 affects all versions of the Linux kernel between 6.9.x and 6.10.14, as well as 6.11.x versions prior to 6.11.3.
What component of the Linux kernel does CVE-2024-49887 impact?
CVE-2024-49887 impacts the f2fs (Flash-Friendly File System) component of the Linux kernel.
What symptoms might indicate exploitation of CVE-2024-49887?
Exploitation of CVE-2024-49887 may manifest as system panics related to no free segment faults during file operations on f2fs.