{"id":"CVE-2024-34027","state":"PUBLISHED","title":"f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case.","publishedAt":"2024-06-24T13:56:49.389Z","updatedAt":"2026-10-15T00:40:44.472Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"a6e1f7744e9b84f86a629a76024bba8468aa153b","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"b5bac43875aa27ec032dbbb86173baae6dce6182","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"5d47d63883735718825ca2efc4fca6915469774f","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"69136304fd144144a4828c7b7b149d0f80321ba4","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"0a4ed2d97cb6d044196cc3e726b6699222b41019","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.219","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.161","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.93","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.4","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/file.c"]}],"references":["https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b","https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182","https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f","https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b","https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4","https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/34xxx/CVE-2024-34027.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-34027","state":"PUBLISHED","datePublished":"2024-06-24T13:56:49.389Z","dateUpdated":"2026-10-15T00:40:44.472Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-06-24T13:54:11.051Z"},"containers":{"cna":{"title":"f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"a6e1f7744e9b84f86a629a76024bba8468aa153b","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"b5bac43875aa27ec032dbbb86173baae6dce6182","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"5d47d63883735718825ca2efc4fca6915469774f","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"69136304fd144144a4828c7b7b149d0f80321ba4","versionType":"git"},{"version":"ef8d563f184e1112651f2cbde383d43e599334e8","status":"affected","lessThan":"0a4ed2d97cb6d044196cc3e726b6699222b41019","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.219","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.161","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.93","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.4","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/file.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"},{"url":"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"},{"url":"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"},{"url":"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"},{"url":"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"},{"url":"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the `F2FS_IOC_RELEASE_COMPRESS_BLOCKS` / `F2FS_IOC_RESERVE_COMPRESS_BLOCKS` ioctls issued on a local file descriptor of a mounted f2fs volume. There is no remote or network-facing path into `f2fs_{release,reserve}_compress_blocks()`.\nAC:L - The attacker drives both sides of the race — one thread loops the compress-block ioctls while another loops unprivileged `syncfs()`, which calls `f2fs_sync_fs(sb, 1)` → `f2fs_issue_checkpoint()`, so the racing checkpoint is attacker-scheduled rather than incidental. Once won, the inconsistent metadata is written to persistent storage and stays there, and f2fs compression is broadly deployed (Android GKI enables `CONFIG_F2FS_FS_COMPRESSION`), so no condition outside the attacker's influence is needed to reach the corrupt state.\nPR:L - Both ioctls carry no `capable()` or `CAP_SYS_ADMIN` check — unlike the adjacent `F2FS_IOC_RESIZE_FS`/`GARBAGE_COLLECT` handlers — and setting `FS_COMPR_FL` requires only `inode_owner_or_capable`. Any unprivileged local user with a file on a rw-mounted compression-enabled f2fs volume can create a compressed file and invoke them.\nUI:N - The attacker operates entirely on a file it creates and owns on an already-mounted filesystem, in a self-contained two-thread loop. No action by any other user or administrator is required.\nS:U - The corruption is confined to the f2fs filesystem metadata managed by the same kernel security authority that hosts the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The persisted mismatch between inode compress accounting (`i_blocks`, `i_compr_blocks`, `FI_COMPRESS_RELEASED`) and the dnode blkaddr layout means a compressed cluster can be decompressed using a block count that no longer matches its real extent, surfacing content of blocks outside the file — a cross-file disclosure on a shared volume, which is why the fs is flagged `SBI_NEED_FSCK` rather than merely losing space.\nI:H - An unprivileged user achieves persistent, unauthorized corruption of shared on-disk filesystem metadata — dnode block addresses, inode `i_blocks`/`i_compr_blocks`, and the volume-global `total_valid_block_count` — affecting the entire filesystem and not just the attacker's own file, repairable only by fsck.\nA:H - After the unclean mount, `f2fs_sanity_check_ckpt()` rejects the volume with \"Wrong valid_user_blocks\" (`-EFSCORRUPTED`), rendering an f2fs root or `/data` unmountable and the device unbootable; `dec_valid_block_count()`'s `f2fs_bug_on(sbi, sbi->total_valid_block_count < count)` also yields a `BUG_ON` kernel panic under `CONFIG_F2FS_CHECK_FS`, with `SBI_NEED_FSCK`/forced read-only otherwise."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:29:52.924Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.219"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.15.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.1.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.9.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"c75488fb4d82","status":"affected","lessThan":"a6e1f7744e9b","versionType":"git"},{"version":"c75488fb4d82","status":"affected","lessThan":"b5bac43875aa","versionType":"git"},{"version":"c75488fb4d82","status":"affected","lessThan":"5d47d6388373","versionType":"git"},{"version":"c75488fb4d82","status":"affected","lessThan":"329edb7c9e3b","versionType":"git"},{"version":"c75488fb4d82","status":"affected","lessThan":"69136304fd14","versionType":"git"},{"version":"c75488fb4d82","status":"affected","lessThan":"0a4ed2d97cb6","versionType":"git"},{"version":"5.8","status":"affected"},{"version":"0","status":"affected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.219","status":"affected","lessThanOrEqual":"5.10*","versionType":"semver"},{"version":"6.1.93","status":"affected","lessThanOrEqual":"6.1*","versionType":"semver"},{"version":"6.6.33","status":"affected","lessThanOrEqual":"6.6*","versionType":"semver"},{"version":"6.94","status":"affected","lessThanOrEqual":"6.9*","versionType":"semver"},{"version":"6.10","status":"affected","lessThanOrEqual":"*","versionType":"semver"},{"version":"5.15.161","status":"affected","lessThanOrEqual":"5.15*","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-11-05T14:50:20.784869Z","id":"CVE-2024-34027","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","type":"CWE","lang":"en","description":"CWE-770 Allocation of Resources Without Limits or Throttling"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-05T15:02:49.178Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T02:42:59.794Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:40:44.472Z"},"x_adpType":"supplier"}]}}}