GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47740 (GCVE-0-2024-47740)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-08-05 11:39
VLAI
Title
f2fs: Require FMODE_WRITE for atomic write ioctls
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:59 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 4ce87674c3a6b4d3b3d45f85b584ab8618a3cece (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 000bab8753ae29a259feb339b99ee759795a48ac (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 88ff021e1fea2d9b40b2d5efd9013c89f7be04ac (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 32f348ecc149e9ca70a1c424ae8fa9b6919d2713 (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 5e0de753bfe87768ebe6744d869caa92f35e5731 (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < f3bfac2cabf5333506b263bc0c8497c95302f32d (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 4583290898c13c2c2e5eb8773886d153c2c5121d (git)
Affected: 88b88a66797159949cec32eaab12b4968f6fae2d , < 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 4.19.323 , ≤ 4.19.* (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:19.414286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:14.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:36.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "000bab8753ae29a259feb339b99ee759795a48ac",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "88ff021e1fea2d9b40b2d5efd9013c89f7be04ac",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "5e0de753bfe87768ebe6744d869caa92f35e5731",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "f3bfac2cabf5333506b263bc0c8497c95302f32d",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4583290898c13c2c2e5eb8773886d153c2c5121d",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: Require FMODE_WRITE for atomic write ioctls\n\nThe F2FS ioctls for starting and committing atomic writes check for\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\n\nThere are scenarios where LSMs want to deny a process the ability to write\nparticular files, even files that the FSUID of the process owns; but this\ncan currently partially be bypassed using atomic write ioctls in two ways:\n\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\n   truncate an inode to size 0\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\n   changes another process concurrently made to a file\n\nFix it by requiring FMODE_WRITE for these operations, just like for\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\nioctls when intending to write into the file, that seems unlikely to break\nanything."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing F2FS_IOC_START_ATOMIC_REPLACE/COMMIT/ABORT ioctls on a local file descriptor for a regular file on a locally-mounted f2fs filesystem. There is no network-reachable path to fs/f2fs/file.c ioctl handlers.\nAC:L - The destructive primitive is two deterministic ioctl calls on an fd the attacker already holds \u2014 no race, no memory-layout dependency, no timing sensitivity. Even the rollback variant is attacker-timed: it chooses when to START and when to ABORT, and any concurrent writes landing in that window are discarded, so a wider window simply catches more.\nPR:L - Only local unprivileged code execution plus an O_RDONLY fd on a file whose UID matches the attacker\u0027s FSUID is needed; inode_owner_or_capable() short-circuits on the UID match, so no capability, user namespace, or root is required. mnt_want_write_file() checks only that the mount is writable, not the fd.\nUI:N - START_ATOMIC_REPLACE + COMMIT_ATOMIC_WRITE truncates the file to zero entirely under attacker control, with no victim action required. The attacker opens the file itself and needs nothing from any other process.\nS:U - The vulnerable f2fs ioctl handler and the impacted files are both governed by the kernel\u0027s security authority; bypassing an in-kernel LSM check is not a crossing into a different authority. No hypervisor, IOMMU, or VM boundary is traversed.\nC:N - The bug is purely a missing write-side access-control check \u2014 the attacker already holds read access to the target file, so nothing new is disclosed. No kernel memory is leaked and no read primitive is created.\nI:H - The attacker gains write-equivalent power over files the security policy explicitly protected from modification: complete irreversible truncation to size 0, and silent rollback of another process\u0027s already-acknowledged writes. For a Landlock- or SELinux-confined process the protected file set is exactly what falls, and every byte of it can be destroyed \u2014 a total loss of integrity for the affected resources.\nA:H - Truncating a target such as a system database, keystore, or configuration file to zero permanently destroys the resource and renders the depending service unavailable. Independently, the attacker can pin the inode in atomic-write state for as long as it chooses, causing all O_DIRECT reads/writes from legitimate processes to fail -EOPNOTSUPP and fallocate/MOVE_RANGE/SET_PIN_FILE/defrag to fail -EINVAL \u2014 a sustained, attacker-controlled denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:50.713Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece"
        },
        {
          "url": "https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e"
        }
      ],
      "title": "f2fs: Require FMODE_WRITE for atomic write ioctls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47740",
    "datePublished": "2024-10-21T12:14:09.171Z",
    "dateReserved": "2024-09-30T16:00:12.959Z",
    "dateUpdated": "2026-08-05T11:39:50.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47740",
      "date": "2026-09-16",
      "epss": "0.00234",
      "percentile": "0.14464"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: Require FMODE_WRITE for atomic write ioctls\\n\\nThe F2FS ioctls for starting and committing atomic writes check for\\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\\n\\nThere are scenarios where LSMs want to deny a process the ability to write\\nparticular files, even files that the FSUID of the process owns; but this\\ncan currently partially be bypassed using atomic write ioctls in two ways:\\n\\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\\n   truncate an inode to size 0\\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\\n   changes another process concurrently made to a file\\n\\nFix it by requiring FMODE_WRITE for these operations, just like for\\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\\nioctls when intending to write into the file, that seems unlikely to break\\nanything.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: Requerir FMODE_WRITE para ioctls de escritura at\\u00f3mica Los ioctls de F2FS para iniciar y confirmar escrituras at\\u00f3micas comprueban inode_owner_or_capable(), pero esto no da a los LSM como SELinux o Landlock la oportunidad de denegar el acceso de escritura: si el FSUID del llamador coincide con el UID del inodo, inode_owner_or_capable() devuelve verdadero inmediatamente. Hay escenarios en los que los LSM quieren denegar a un proceso la capacidad de escribir archivos particulares, incluso archivos que el FSUID del proceso posee; pero esto actualmente se puede omitir parcialmente usando ioctls de escritura at\\u00f3mica de dos maneras: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE puede truncar un inodo a tama\\u00f1o 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE puede revertir los cambios que otro proceso realiz\\u00f3 simult\\u00e1neamente en un archivo Arr\\u00e9glelo requiriendo FMODE_WRITE para estas operaciones, al igual que para F2FS_IOC_MOVE_RANGE. Dado que cualquier llamador leg\\u00edtimo solo debe usar estos ioctls cuando tenga la intenci\\u00f3n de escribir en el archivo, parece poco probable que eso rompa algo.\"}]",
      "id": "CVE-2024-47740",
      "lastModified": "2024-11-08T16:15:27.477",
      "published": "2024-10-21T13:15:04.103",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47740\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:04.103\",\"lastModified\":\"2026-08-04T11:20:46.590\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: Require FMODE_WRITE for atomic write ioctls\\n\\nThe F2FS ioctls for starting and committing atomic writes check for\\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\\n\\nThere are scenarios where LSMs want to deny a process the ability to write\\nparticular files, even files that the FSUID of the process owns; but this\\ncan currently partially be bypassed using atomic write ioctls in two ways:\\n\\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\\n   truncate an inode to size 0\\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\\n   changes another process concurrently made to a file\\n\\nFix it by requiring FMODE_WRITE for these operations, just like for\\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\\nioctls when intending to write into the file, that seems unlikely to break\\nanything.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: Requerir FMODE_WRITE para ioctls de escritura at\u00f3mica Los ioctls de F2FS para iniciar y confirmar escrituras at\u00f3micas comprueban inode_owner_or_capable(), pero esto no da a los LSM como SELinux o Landlock la oportunidad de denegar el acceso de escritura: si el FSUID del llamador coincide con el UID del inodo, inode_owner_or_capable() devuelve verdadero inmediatamente. Hay escenarios en los que los LSM quieren denegar a un proceso la capacidad de escribir archivos particulares, incluso archivos que el FSUID del proceso posee; pero esto actualmente se puede omitir parcialmente usando ioctls de escritura at\u00f3mica de dos maneras: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE puede truncar un inodo a tama\u00f1o 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE puede revertir los cambios que otro proceso realiz\u00f3 simult\u00e1neamente en un archivo Arr\u00e9glelo requiriendo FMODE_WRITE para estas operaciones, al igual que para F2FS_IOC_MOVE_RANGE. Dado que cualquier llamador leg\u00edtimo solo debe usar estos ioctls cuando tenga la intenci\u00f3n de escribir en el archivo, parece poco probable que eso rompa algo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"000bab8753ae29a259feb339b99ee759795a48ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"32f348ecc149e9ca70a1c424ae8fa9b6919d2713\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"5e0de753bfe87768ebe6744d869caa92f35e5731\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"f3bfac2cabf5333506b263bc0c8497c95302f32d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"4583290898c13c2c2e5eb8773886d153c2c5121d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88b88a66797159949cec32eaab12b4968f6fae2d\",\"lessThan\":\"4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:59:19.414286Z\",\"id\":\"CVE-2024-47740\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"4CF15846-AEEF-4FBF-BED3-18AFD682270F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"795A3EE6-0CAB-4409-A903-151C94ACECC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:53:41+00:00",
      "cve": "CVE-2024-47740",
      "id": "CVE-2024-47740",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: Require FMODE_WRITE for atomic write ioctls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47740.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:21:11Z",
      "cve": "CVE-2024-47740",
      "id": "CVE-2024-47740",
      "initial_release_date": "2024-10-21T15:46:27Z",
      "product_status:known_not_affected": "498",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47740",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47740.json",
      "version": "27"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:36.961Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:19.414286Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:22.941Z\"}}], \"cna\": {\"title\": \"f2fs: Require FMODE_WRITE for atomic write ioctls\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires issuing F2FS_IOC_START_ATOMIC_REPLACE/COMMIT/ABORT ioctls on a local file descriptor for a regular file on a locally-mounted f2fs filesystem. There is no network-reachable path to fs/f2fs/file.c ioctl handlers.\\nAC:L - The destructive primitive is two deterministic ioctl calls on an fd the attacker already holds \\u2014 no race, no memory-layout dependency, no timing sensitivity. Even the rollback variant is attacker-timed: it chooses when to START and when to ABORT, and any concurrent writes landing in that window are discarded, so a wider window simply catches more.\\nPR:L - Only local unprivileged code execution plus an O_RDONLY fd on a file whose UID matches the attacker\u0027s FSUID is needed; inode_owner_or_capable() short-circuits on the UID match, so no capability, user namespace, or root is required. mnt_want_write_file() checks only that the mount is writable, not the fd.\\nUI:N - START_ATOMIC_REPLACE + COMMIT_ATOMIC_WRITE truncates the file to zero entirely under attacker control, with no victim action required. The attacker opens the file itself and needs nothing from any other process.\\nS:U - The vulnerable f2fs ioctl handler and the impacted files are both governed by the kernel\u0027s security authority; bypassing an in-kernel LSM check is not a crossing into a different authority. No hypervisor, IOMMU, or VM boundary is traversed.\\nC:N - The bug is purely a missing write-side access-control check \\u2014 the attacker already holds read access to the target file, so nothing new is disclosed. No kernel memory is leaked and no read primitive is created.\\nI:H - The attacker gains write-equivalent power over files the security policy explicitly protected from modification: complete irreversible truncation to size 0, and silent rollback of another process\u0027s already-acknowledged writes. For a Landlock- or SELinux-confined process the protected file set is exactly what falls, and every byte of it can be destroyed \\u2014 a total loss of integrity for the affected resources.\\nA:H - Truncating a target such as a system database, keystore, or configuration file to zero permanently destroys the resource and renders the depending service unavailable. Independently, the attacker can pin the inode in atomic-write state for as long as it chooses, causing all O_DIRECT reads/writes from legitimate processes to fail -EOPNOTSUPP and fallocate/MOVE_RANGE/SET_PIN_FILE/defrag to fail -EINVAL \\u2014 a sustained, attacker-controlled denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"000bab8753ae29a259feb339b99ee759795a48ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"32f348ecc149e9ca70a1c424ae8fa9b6919d2713\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"5e0de753bfe87768ebe6744d869caa92f35e5731\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"f3bfac2cabf5333506b263bc0c8497c95302f32d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4583290898c13c2c2e5eb8773886d153c2c5121d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\"}, {\"url\": \"https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\"}, {\"url\": \"https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac\"}, {\"url\": \"https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\"}, {\"url\": \"https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713\"}, {\"url\": \"https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731\"}, {\"url\": \"https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d\"}, {\"url\": \"https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d\"}, {\"url\": \"https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: Require FMODE_WRITE for atomic write ioctls\\n\\nThe F2FS ioctls for starting and committing atomic writes check for\\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\\n\\nThere are scenarios where LSMs want to deny a process the ability to write\\nparticular files, even files that the FSUID of the process owns; but this\\ncan currently partially be bypassed using atomic write ioctls in two ways:\\n\\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\\n   truncate an inode to size 0\\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\\n   changes another process concurrently made to a file\\n\\nFix it by requiring FMODE_WRITE for these operations, just like for\\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\\nioctls when intending to write into the file, that seems unlikely to break\\nanything.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:39:50.713Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:39:50.713Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:09.171Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.