CVE-2024-27032
f2fs: fix to avoid potential panic during recovery
MEDIUM 6.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.29 % · centile 22 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential panic during recovery During recovery, if FAULT_BLOCK is on, it is possible that f2fs_reserve_new_block() will return -ENOSPC during recovery, then it may trigger panic. Also, if fault injection rate is 1 and only FAULT_BLOCK fault type is on, it may encounter deadloop in loop of block reservation. Let's change as below to fix these issues: - remove bug_on() to avoid panic. - limit the loop count of block reservation to avoid potential deadloop.
Faiblesses (CWE)
- CWE-835 — Boucle dont la condition de sortie est inatteignable (boucle infinie)
Références
- https://git.kernel.org/stable/c/fe4de493572a4263554903bf9c3afc5c196e15f0
- https://git.kernel.org/stable/c/8844b2f8a3f0c428b74672f9726f9950b1a7764c
- https://git.kernel.org/stable/c/d034810d02a5af8eb74debe29877dcaf5f00fdd1
- https://git.kernel.org/stable/c/f26091a981318b5b7451d61f99bc073a6af8db67
- https://git.kernel.org/stable/c/21ec68234826b1b54ab980a8df6e33c74cfbee58
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-24294
- GCVE · GCVE-0-2024-27032
Avis du CERT-FR
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0546 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.307 < 4.20cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.269 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.210 < 5.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.149 < 5.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.77 < 6.1.83cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.16 < 6.6.23cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7.4 < 6.7.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.8 < 6.8.2
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected b1020a546779139eec5d930e15ce534c1101b89c < fe4de493572a4263554903bf9c3afc5c196e15f0 ; affected 2a7b12d4705bc308cf18eae2b69ec8db34881cc3 < 8844b2f8a3f0c428b74672f9726f9950b1a7764c ; affected b29cc6e29b5e6037e1bcd2b2ac67b7d89acd194c < d034810d02a5af8eb74debe29877dcaf5f00fdd1 ; affected 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd < f26091a981318b5b7451d61f99bc073a6af8db67 ; affected 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd < 21ec68234826b1b54ab980a8df6e33c74cfbee58 ; affected bc1fb291f36dd1d9d667241d9fe30b835dbb8ee8 |
| Linux · Linux | affected 6.8 ; unaffected 0 < 6.8 ; unaffected 6.1.83 ≤ 6.1.* ; unaffected 6.6.23 ≤ 6.6.* ; unaffected 6.7.11 ≤ 6.7.* ; unaffected 6.8.2 ≤ 6.8.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |