CVE-2024-27034 (GCVE-0-2024-27034)

Vulnerability from cvelistv5 – Published: 2024-05-01 12:53 – Updated: 2026-08-05 11:29
VLAI
Title
f2fs: compress: fix to cover normal cluster write with cp_rwsem
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data will be corrupted if partial blocks were persisted before CP & SPOR, due to cluster metadata wasn't updated atomically.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-09 18:39 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416 (git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 542c8b3c774a480bfd0804291a12f6f2391b0cd1 (git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 75abfd61392b1db391bde6d738a30d685b843286 (git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 2b1b14d9fc94b8feae20808684c8af28ec80f45b (git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < 52982edfcefd475cc34af663d5c47c0cddaa5739 (git)
Affected: 4c8ff7095bef64fc47e996a938f7d57f9e077da3 , < fd244524c2cf07b5f4c3fe8abd6a99225c76544b (git)
Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.15.153 , ≤ 5.15.* (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T18:39:02.187775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:46.153Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/compress.c",
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            },
            {
              "lessThan": "542c8b3c774a480bfd0804291a12f6f2391b0cd1",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            },
            {
              "lessThan": "75abfd61392b1db391bde6d738a30d685b843286",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            },
            {
              "lessThan": "2b1b14d9fc94b8feae20808684c8af28ec80f45b",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            },
            {
              "lessThan": "52982edfcefd475cc34af663d5c47c0cddaa5739",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            },
            {
              "lessThan": "fd244524c2cf07b5f4c3fe8abd6a99225c76544b",
              "status": "affected",
              "version": "4c8ff7095bef64fc47e996a938f7d57f9e077da3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/compress.c",
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover normal cluster write with cp_rwsem\n\nWhen we overwrite compressed cluster w/ normal cluster, we should\nnot unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data\nwill be corrupted if partial blocks were persisted before CP \u0026 SPOR,\ndue to cluster metadata wasn\u0027t updated atomically."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through ordinary local file I/O on an f2fs filesystem \u2014 write(2)/mmap dirty pages on a compression-enabled file plus writeback, with syncfs(2) driving the concurrent checkpoint. No network protocol handler is involved.\nAC:L - The attacker controls both sides of the race: one thread overwrites a compressed cluster with incompressible data to enter f2fs_write_raw_pages(), while another thread repeatedly calls the unprivileged syncfs(2), which takes cp_rwsem for write in the window the writer drops it between pages. No condition outside attacker influence is needed to create the inconsistent on-disk cluster state.\nPR:L - Only an unprivileged local account with write access to a file on the f2fs mount is required; f2fs_setflags_common() permits any file owner to set F2FS_COMPR_FL via FS_IOC_SETFLAGS, and compress_extension= mount options enable it automatically. No capability check exists on the write, writeback, or syncfs paths.\nUI:N - The attacker performs every step itself \u2014 creating the compressed file, overwriting the cluster, and forcing checkpoints. On Android and embedded devices the f2fs volume is already mounted at boot, so no victim action is needed.\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it; no security authority boundary such as a VM, hypervisor, or IOMMU domain is crossed.\nC:H - Non-atomic cluster conversion corrupts dnode block addresses together with i_compr_blocks and total_valid_block_count, so blocks can become cross-linked \u2014 an attacker-controlled file ends up referencing blocks the allocator has reassigned to another user\u0027s file, exposing their contents on read. Half-converted clusters also cause stale compressed blocks to be decompressed into the attacker\u0027s page cache.\nI:H - This is fundamentally an integrity bug: the commit states data will be corrupted because cluster metadata is not updated atomically, and the resulting inconsistent dnode blkaddrs, i_blocks, and total_valid_block_count are persistent on-disk filesystem corruption that requires fsck. Cross-linked blocks additionally let the attacker overwrite data belonging to other files.\nA:H - The corrupted cluster makes f2fs_sanity_check_cluster()/__f2fs_cluster_blocks() return -EFSCORRUPTED and set SBI_NEED_FSCK, and f2fs_handle_error() can force the filesystem read-only or panic the kernel under errors=panic. On an embedded, automotive, or Android device whose rootfs/userdata is f2fs, the corrupted volume renders the system unbootable until repaired."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:08.856Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416"
        },
        {
          "url": "https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b"
        },
        {
          "url": "https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b"
        }
      ],
      "title": "f2fs: compress: fix to cover normal cluster write with cp_rwsem",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27034",
    "datePublished": "2024-05-01T12:53:39.767Z",
    "dateReserved": "2024-02-19T14:20:24.211Z",
    "dateUpdated": "2026-08-05T11:29:08.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27034",
      "date": "2026-08-14",
      "epss": "0.00284",
      "percentile": "0.20742"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover normal cluster write with cp_rwsem\\n\\nWhen we overwrite compressed cluster w/ normal cluster, we should\\nnot unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data\\nwill be corrupted if partial blocks were persisted before CP \u0026 SPOR,\\ndue to cluster metadata wasn\u0027t updated atomically.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: f2fs: compress: correcci\\u00f3n para cubrir la escritura normal del cl\\u00faster con cp_rwsem Cuando sobrescribimos el cl\\u00faster comprimido con el cl\\u00faster normal, no debemos desbloquear cp_rwsem durante f2fs_write_raw_pages(); de lo contrario, los datos se da\\u00f1ar\\u00e1n si Los bloques parciales persistieron antes de CP y SPOR, debido a que los metadatos del cl\\u00faster no se actualizaron at\\u00f3micamente.\"}]",
      "id": "CVE-2024-27034",
      "lastModified": "2024-11-21T09:03:42.663",
      "published": "2024-05-01T13:15:49.317",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27034\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:49.317\",\"lastModified\":\"2026-08-04T11:17:36.413\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover normal cluster write with cp_rwsem\\n\\nWhen we overwrite compressed cluster w/ normal cluster, we should\\nnot unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data\\nwill be corrupted if partial blocks were persisted before CP \u0026 SPOR,\\ndue to cluster metadata wasn\u0027t updated atomically.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: f2fs: compress: correcci\u00f3n para cubrir la escritura normal del cl\u00faster con cp_rwsem Cuando sobrescribimos el cl\u00faster comprimido con el cl\u00faster normal, no debemos desbloquear cp_rwsem durante f2fs_write_raw_pages(); de lo contrario, los datos se da\u00f1ar\u00e1n si Los bloques parciales persistieron antes de CP y SPOR, debido a que los metadatos del cl\u00faster no se actualizaron at\u00f3micamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/compress.c\",\"fs/f2fs/data.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"542c8b3c774a480bfd0804291a12f6f2391b0cd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"75abfd61392b1db391bde6d738a30d685b843286\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"2b1b14d9fc94b8feae20808684c8af28ec80f45b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"52982edfcefd475cc34af663d5c47c0cddaa5739\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c8ff7095bef64fc47e996a938f7d57f9e077da3\",\"lessThan\":\"fd244524c2cf07b5f4c3fe8abd6a99225c76544b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/compress.c\",\"fs/f2fs/data.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.153\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.83\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-09T18:39:02.187775Z\",\"id\":\"CVE-2024-27034\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.15.153\",\"matchCriteriaId\":\"5DF12F4F-0479-46F6-AF7F-50D1E1170B91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.83\",\"matchCriteriaId\":\"121A07F6-F505-4C47-86BF-9BB6CC7B6C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:06:49+00:00",
      "cve": "CVE-2024-27034",
      "id": "CVE-2024-27034",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: compress: fix to cover normal cluster write with cp_rwsem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27034.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:08:04Z",
      "cve": "CVE-2024-27034",
      "id": "CVE-2024-27034",
      "initial_release_date": "2024-05-03T02:09:37Z",
      "product_status:known_not_affected": "332",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27034",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27034.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.902Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27034\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-09T18:39:02.187775Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:43.816Z\"}}], \"cna\": {\"title\": \"f2fs: compress: fix to cover normal cluster write with cp_rwsem\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through ordinary local file I/O on an f2fs filesystem \\u2014 write(2)/mmap dirty pages on a compression-enabled file plus writeback, with syncfs(2) driving the concurrent checkpoint. No network protocol handler is involved.\\nAC:L - The attacker controls both sides of the race: one thread overwrites a compressed cluster with incompressible data to enter f2fs_write_raw_pages(), while another thread repeatedly calls the unprivileged syncfs(2), which takes cp_rwsem for write in the window the writer drops it between pages. No condition outside attacker influence is needed to create the inconsistent on-disk cluster state.\\nPR:L - Only an unprivileged local account with write access to a file on the f2fs mount is required; f2fs_setflags_common() permits any file owner to set F2FS_COMPR_FL via FS_IOC_SETFLAGS, and compress_extension= mount options enable it automatically. No capability check exists on the write, writeback, or syncfs paths.\\nUI:N - The attacker performs every step itself \\u2014 creating the compressed file, overwriting the cluster, and forcing checkpoints. On Android and embedded devices the f2fs volume is already mounted at boot, so no victim action is needed.\\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it; no security authority boundary such as a VM, hypervisor, or IOMMU domain is crossed.\\nC:H - Non-atomic cluster conversion corrupts dnode block addresses together with i_compr_blocks and total_valid_block_count, so blocks can become cross-linked \\u2014 an attacker-controlled file ends up referencing blocks the allocator has reassigned to another user\u0027s file, exposing their contents on read. Half-converted clusters also cause stale compressed blocks to be decompressed into the attacker\u0027s page cache.\\nI:H - This is fundamentally an integrity bug: the commit states data will be corrupted because cluster metadata is not updated atomically, and the resulting inconsistent dnode blkaddrs, i_blocks, and total_valid_block_count are persistent on-disk filesystem corruption that requires fsck. Cross-linked blocks additionally let the attacker overwrite data belonging to other files.\\nA:H - The corrupted cluster makes f2fs_sanity_check_cluster()/__f2fs_cluster_blocks() return -EFSCORRUPTED and set SBI_NEED_FSCK, and f2fs_handle_error() can force the filesystem read-only or panic the kernel under errors=panic. On an embedded, automotive, or Android device whose rootfs/userdata is f2fs, the corrupted volume renders the system unbootable until repaired.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"542c8b3c774a480bfd0804291a12f6f2391b0cd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"75abfd61392b1db391bde6d738a30d685b843286\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"2b1b14d9fc94b8feae20808684c8af28ec80f45b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"52982edfcefd475cc34af663d5c47c0cddaa5739\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4c8ff7095bef64fc47e996a938f7d57f9e077da3\", \"lessThan\": \"fd244524c2cf07b5f4c3fe8abd6a99225c76544b\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/compress.c\", \"fs/f2fs/data.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.153\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/compress.c\", \"fs/f2fs/data.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416\"}, {\"url\": \"https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1\"}, {\"url\": \"https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286\"}, {\"url\": \"https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b\"}, {\"url\": \"https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739\"}, {\"url\": \"https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover normal cluster write with cp_rwsem\\n\\nWhen we overwrite compressed cluster w/ normal cluster, we should\\nnot unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data\\nwill be corrupted if partial blocks were persisted before CP \u0026 SPOR,\\ndue to cluster metadata wasn\u0027t updated atomically.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.153\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.83\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:08.856Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27034\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:08.856Z\", \"dateReserved\": \"2024-02-19T14:20:24.211Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T12:53:39.767Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.