{"id":"CVE-2024-40971","state":"PUBLISHED","title":"f2fs: remove clear SB_INLINECRYPT flag in default_options","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this gap, these files\nwill not use inlinecrypt. Worse case, it may lead to data\ncorruption if wrappedkey_v0 is enable.\n\nThread A:                               Thread B:\n\n-f2fs_remount\t\t\t\t-f2fs_file_open or f2fs_new_inode\n  -default_options\n\t<- clear SB_INLINECRYPT flag\n\n                                          -fscrypt_select_encryption_impl\n\n  -parse_options\n\t<- set SB_INLINECRYPT again","publishedAt":"2024-07-12T12:32:09.440Z","updatedAt":"2026-10-15T00:46:18.132Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"724429db09e21ee153fef35e34342279d33df6ae","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"a9cea0489c562c97cd56bb345e78939f9909e7f4","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"eddeb8d941d5be11a9da5637dbe81ac37e8449a2","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"ae39c8ec4250d2a35ddaab1c40faacfec306ff66","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"ac5eecf481c29942eb9a862e758c0c8b68090c33","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"5.10.221","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.162","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.96","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.36","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.7","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"]}],"references":["https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae","https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4","https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2","https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66","https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/40xxx/CVE-2024-40971.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-40971","state":"PUBLISHED","datePublished":"2024-07-12T12:32:09.440Z","dateUpdated":"2026-10-15T00:46:18.132Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-12T12:17:45.603Z"},"containers":{"cna":{"title":"f2fs: remove clear SB_INLINECRYPT flag in default_options","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this gap, these files\nwill not use inlinecrypt. Worse case, it may lead to data\ncorruption if wrappedkey_v0 is enable.\n\nThread A:                               Thread B:\n\n-f2fs_remount\t\t\t\t-f2fs_file_open or f2fs_new_inode\n  -default_options\n\t<- clear SB_INLINECRYPT flag\n\n                                          -fscrypt_select_encryption_impl\n\n  -parse_options\n\t<- set SB_INLINECRYPT again"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"724429db09e21ee153fef35e34342279d33df6ae","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"a9cea0489c562c97cd56bb345e78939f9909e7f4","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"eddeb8d941d5be11a9da5637dbe81ac37e8449a2","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"ae39c8ec4250d2a35ddaab1c40faacfec306ff66","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"ac5eecf481c29942eb9a862e758c0c8b68090c33","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"5.10.221","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.162","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.96","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.36","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.7","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71"},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae"},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4"},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2"},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66"},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The affected code is reached exclusively through local syscalls — `mount(2)` remount on one side and `open(2)`/`creat(2)`/`mkdir(2)` on the other. No network protocol handler or remote peer data is involved.\nAC:L - There is no tight race to win: whenever the remount option string omits `inlinecrypt`, `SB_INLINECRYPT` stays cleared for the full duration of the remount (which includes multi-second work such as `f2fs_disable_checkpoint()`'s GC loop) or permanently on success, and the attacker simply runs a continuous file-creation loop, which is entirely under their control. f2fs remounts are routine, frequent system operations on the primary deployment (Android `/data`, embedded ro→rw transitions), not an extenuating circumstance.\nPR:L - The exploiting side — opening or creating files on the encrypted f2fs mount so they latch `ci_inlinecrypt = false` — requires only an ordinary unprivileged local account, with no capability check anywhere on the `f2fs_file_open()`/`f2fs_new_inode()` path. Only the environmental remount needs CAP_SYS_ADMIN, and that is a routine system action, not a privilege the attacker must hold.\nUI:N - The attacker performs their own file creations with no action required from another human; the remount is an automated system operation performed by init/vold/systemd during boot, user unlock, or OTA, not an interactive victim step.\nS:U - The mis-selected encryption implementation and the resulting corruption stay within the f2fs superblock and the kernel's own security authority. No VM, IOMMU, container, or sandbox boundary is crossed.\nC:L - The bug silently downgrades file-contents encryption from the inline crypto engine — where, with hardware-wrapped keys, key material never leaves the hardware key slots — to the software crypto API, materializing usable key material in kernel RAM on vendor kernels that permit the fallback and defeating the protection the `inlinecrypt` mount option was chosen to provide. Data is still encrypted on disk, so this is a limited weakening rather than an arbitrary read.\nI:H - Files created or opened while the flag is cleared are permanently bound to the wrong crypto implementation, so with `wrappedkey_v0` their contents are written under a different key than the one used on read-back, producing silent, persistent, unrecoverable corruption of user data on the encrypted partition — exactly the \"data corruption\" the fix commit describes. The corruption survives reboot and is not detectable or repairable by the affected application.\nA:H - On kernels with hardware-wrapped key support, `fscrypt_setup_v2_file_key()` returns `-EINVAL` for every regular-file open when inline crypt was not selected, so the entire encrypted data partition becomes inaccessible for the duration of the window — or indefinitely if the remount omitted `inlinecrypt` — rendering an Android/embedded device unusable. Corrupted system files on `/data` additionally force a factory reset to recover."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:34:19.550Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.10.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.15.162"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.9.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:58:36.200Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-40971","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:02:54.463850Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:22.540Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:46:18.132Z"},"x_adpType":"supplier"}]}}}