GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-34027 (GCVE-0-2024-34027)

Vulnerability from cvelistv5 – Published: 2024-06-24 13:56 – Updated: 2026-08-05 11:29
VLAI
Title
f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode, inode fields and .total_valid_block_count may be corrupted after SPO case.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-05 14:50 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < a6e1f7744e9b84f86a629a76024bba8468aa153b (git)
Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < b5bac43875aa27ec032dbbb86173baae6dce6182 (git)
Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < 5d47d63883735718825ca2efc4fca6915469774f (git)
Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < 329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b (git)
Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < 69136304fd144144a4828c7b7b149d0f80321ba4 (git)
Affected: ef8d563f184e1112651f2cbde383d43e599334e8 , < 0a4ed2d97cb6d044196cc3e726b6699222b41019 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.219 , ≤ 5.10.* (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.9.4 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: c75488fb4d82 , < a6e1f7744e9b (git)
Affected: c75488fb4d82 , < b5bac43875aa (git)
Affected: c75488fb4d82 , < 5d47d6388373 (git)
Affected: c75488fb4d82 , < 329edb7c9e3b (git)
Affected: c75488fb4d82 , < 69136304fd14 (git)
Affected: c75488fb4d82 , < 0a4ed2d97cb6 (git)
Affected: 5.8
Affected: 0 , < 5.8 (semver)
Affected: 5.10.219 , ≤ 5.10* (semver)
Affected: 6.1.93 , ≤ 6.1* (semver)
Affected: 6.6.33 , ≤ 6.6* (semver)
Affected: 6.94 , ≤ 6.9* (semver)
Affected: 6.10 , ≤ * (semver)
Affected: 5.15.161 , ≤ 5.15* (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "a6e1f7744e9b",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "lessThan": "b5bac43875aa",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "lessThan": "5d47d6388373",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "lessThan": "329edb7c9e3b",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "lessThan": "69136304fd14",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "lessThan": "0a4ed2d97cb6",
                "status": "affected",
                "version": "c75488fb4d82",
                "versionType": "git"
              },
              {
                "status": "affected",
                "version": "5.8"
              },
              {
                "lessThan": "5.8",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10*",
                "status": "affected",
                "version": "5.10.219",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1*",
                "status": "affected",
                "version": "6.1.93",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6*",
                "status": "affected",
                "version": "6.6.33",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.9*",
                "status": "affected",
                "version": "6.94",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "6.10",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15*",
                "status": "affected",
                "version": "5.15.161",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T14:50:20.784869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:02:49.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:42:59.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:51:57.302Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6e1f7744e9b84f86a629a76024bba8468aa153b",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            },
            {
              "lessThan": "b5bac43875aa27ec032dbbb86173baae6dce6182",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            },
            {
              "lessThan": "5d47d63883735718825ca2efc4fca6915469774f",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            },
            {
              "lessThan": "329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            },
            {
              "lessThan": "69136304fd144144a4828c7b7b149d0f80321ba4",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            },
            {
              "lessThan": "0a4ed2d97cb6d044196cc3e726b6699222b41019",
              "status": "affected",
              "version": "ef8d563f184e1112651f2cbde383d43e599334e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the `F2FS_IOC_RELEASE_COMPRESS_BLOCKS` / `F2FS_IOC_RESERVE_COMPRESS_BLOCKS` ioctls issued on a local file descriptor of a mounted f2fs volume. There is no remote or network-facing path into `f2fs_{release,reserve}_compress_blocks()`.\nAC:L - The attacker drives both sides of the race \u2014 one thread loops the compress-block ioctls while another loops unprivileged `syncfs()`, which calls `f2fs_sync_fs(sb, 1)` \u2192 `f2fs_issue_checkpoint()`, so the racing checkpoint is attacker-scheduled rather than incidental. Once won, the inconsistent metadata is written to persistent storage and stays there, and f2fs compression is broadly deployed (Android GKI enables `CONFIG_F2FS_FS_COMPRESSION`), so no condition outside the attacker\u0027s influence is needed to reach the corrupt state.\nPR:L - Both ioctls carry no `capable()` or `CAP_SYS_ADMIN` check \u2014 unlike the adjacent `F2FS_IOC_RESIZE_FS`/`GARBAGE_COLLECT` handlers \u2014 and setting `FS_COMPR_FL` requires only `inode_owner_or_capable`. Any unprivileged local user with a file on a rw-mounted compression-enabled f2fs volume can create a compressed file and invoke them.\nUI:N - The attacker operates entirely on a file it creates and owns on an already-mounted filesystem, in a self-contained two-thread loop. No action by any other user or administrator is required.\nS:U - The corruption is confined to the f2fs filesystem metadata managed by the same kernel security authority that hosts the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The persisted mismatch between inode compress accounting (`i_blocks`, `i_compr_blocks`, `FI_COMPRESS_RELEASED`) and the dnode blkaddr layout means a compressed cluster can be decompressed using a block count that no longer matches its real extent, surfacing content of blocks outside the file \u2014 a cross-file disclosure on a shared volume, which is why the fs is flagged `SBI_NEED_FSCK` rather than merely losing space.\nI:H - An unprivileged user achieves persistent, unauthorized corruption of shared on-disk filesystem metadata \u2014 dnode block addresses, inode `i_blocks`/`i_compr_blocks`, and the volume-global `total_valid_block_count` \u2014 affecting the entire filesystem and not just the attacker\u0027s own file, repairable only by fsck.\nA:H - After the unclean mount, `f2fs_sanity_check_ckpt()` rejects the volume with \"Wrong valid_user_blocks\" (`-EFSCORRUPTED`), rendering an f2fs root or `/data` unmountable and the device unbootable; `dec_valid_block_count()`\u0027s `f2fs_bug_on(sbi, sbi-\u003etotal_valid_block_count \u003c count)` also yields a `BUG_ON` kernel panic under `CONFIG_F2FS_CHECK_FS`, with `SBI_NEED_FSCK`/forced read-only otherwise."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:52.924Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"
        },
        {
          "url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"
        }
      ],
      "title": "f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-34027",
    "datePublished": "2024-06-24T13:56:49.389Z",
    "dateReserved": "2024-06-24T13:54:11.051Z",
    "dateUpdated": "2026-08-05T11:29:52.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-34027",
      "date": "2026-09-15",
      "epss": "0.00237",
      "percentile": "0.14813"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\n\\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\nto avoid racing with checkpoint, otherwise, filesystem metadata including\\nblkaddr in dnode, inode fields and .total_valid_block_count may be\\ncorrupted after SPO case.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: compress: correcci\\u00f3n para cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem Necesita cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem para evitar ejecuciones con el punto de control; de lo contrario, los metadatos del sistema de archivos, incluido blkaddr en dnode, los campos de inodo y .total_valid_block_count, pueden da\\u00f1arse despu\\u00e9s del caso SPO.\"}]",
      "id": "CVE-2024-34027",
      "lastModified": "2024-11-21T09:17:56.563",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
      "published": "2024-06-24T14:15:11.887",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-34027\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-24T14:15:11.887\",\"lastModified\":\"2026-08-04T11:17:51.513\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\n\\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\nto avoid racing with checkpoint, otherwise, filesystem metadata including\\nblkaddr in dnode, inode fields and .total_valid_block_count may be\\ncorrupted after SPO case.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: compress: correcci\u00f3n para cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem Necesita cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem para evitar ejecuciones con el punto de control; de lo contrario, los metadatos del sistema de archivos, incluido blkaddr en dnode, los campos de inodo y .total_valid_block_count, pueden da\u00f1arse despu\u00e9s del caso SPO.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"a6e1f7744e9b84f86a629a76024bba8468aa153b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"b5bac43875aa27ec032dbbb86173baae6dce6182\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"5d47d63883735718825ca2efc4fca6915469774f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"69136304fd144144a4828c7b7b149d0f80321ba4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef8d563f184e1112651f2cbde383d43e599334e8\",\"lessThan\":\"0a4ed2d97cb6d044196cc3e726b6699222b41019\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.4\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"c75488fb4d82\",\"lessThan\":\"a6e1f7744e9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c75488fb4d82\",\"lessThan\":\"b5bac43875aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c75488fb4d82\",\"lessThan\":\"5d47d6388373\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c75488fb4d82\",\"lessThan\":\"329edb7c9e3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c75488fb4d82\",\"lessThan\":\"69136304fd14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c75488fb4d82\",\"lessThan\":\"0a4ed2d97cb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.10*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.94\",\"lessThanOrEqual\":\"6.9*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-11-05T14:50:20.784869Z\",\"id\":\"CVE-2024-34027\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"A3C0D860-7856-4982-83DA-17AFB1195E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"31130639-53FE-4726-8986-434EE2528CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.4\",\"matchCriteriaId\":\"991B9791-966A-4D18-9E8D-A8AB128E5627\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:36:37+00:00",
      "cve": "CVE-2024-34027",
      "id": "CVE-2024-34027",
      "initial_release_date": "2024-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-34027.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:31:52Z",
      "cve": "CVE-2024-34027",
      "id": "CVE-2024-34027",
      "initial_release_date": "2024-06-24T23:18:46Z",
      "product_status:known_not_affected": "316",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-34027",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-34027.json",
      "version": "28"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:42:59.794Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:51:57.302Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-34027\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-05T14:50:20.784869Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"a6e1f7744e9b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"b5bac43875aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"5d47d6388373\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"329edb7c9e3b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"69136304fd14\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75488fb4d82\", \"lessThan\": \"0a4ed2d97cb6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10*\"}, {\"status\": \"affected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1*\"}, {\"status\": \"affected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6*\"}, {\"status\": \"affected\", \"version\": \"6.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9*\"}, {\"status\": \"affected\", \"version\": \"6.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"*\"}, {\"status\": \"affected\", \"version\": \"5.15.161\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-25T13:24:40.353Z\"}}], \"cna\": {\"title\": \"f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached only through the `F2FS_IOC_RELEASE_COMPRESS_BLOCKS` / `F2FS_IOC_RESERVE_COMPRESS_BLOCKS` ioctls issued on a local file descriptor of a mounted f2fs volume. There is no remote or network-facing path into `f2fs_{release,reserve}_compress_blocks()`.\\nAC:L - The attacker drives both sides of the race \\u2014 one thread loops the compress-block ioctls while another loops unprivileged `syncfs()`, which calls `f2fs_sync_fs(sb, 1)` \\u2192 `f2fs_issue_checkpoint()`, so the racing checkpoint is attacker-scheduled rather than incidental. Once won, the inconsistent metadata is written to persistent storage and stays there, and f2fs compression is broadly deployed (Android GKI enables `CONFIG_F2FS_FS_COMPRESSION`), so no condition outside the attacker\u0027s influence is needed to reach the corrupt state.\\nPR:L - Both ioctls carry no `capable()` or `CAP_SYS_ADMIN` check \\u2014 unlike the adjacent `F2FS_IOC_RESIZE_FS`/`GARBAGE_COLLECT` handlers \\u2014 and setting `FS_COMPR_FL` requires only `inode_owner_or_capable`. Any unprivileged local user with a file on a rw-mounted compression-enabled f2fs volume can create a compressed file and invoke them.\\nUI:N - The attacker operates entirely on a file it creates and owns on an already-mounted filesystem, in a self-contained two-thread loop. No action by any other user or administrator is required.\\nS:U - The corruption is confined to the f2fs filesystem metadata managed by the same kernel security authority that hosts the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The persisted mismatch between inode compress accounting (`i_blocks`, `i_compr_blocks`, `FI_COMPRESS_RELEASED`) and the dnode blkaddr layout means a compressed cluster can be decompressed using a block count that no longer matches its real extent, surfacing content of blocks outside the file \\u2014 a cross-file disclosure on a shared volume, which is why the fs is flagged `SBI_NEED_FSCK` rather than merely losing space.\\nI:H - An unprivileged user achieves persistent, unauthorized corruption of shared on-disk filesystem metadata \\u2014 dnode block addresses, inode `i_blocks`/`i_compr_blocks`, and the volume-global `total_valid_block_count` \\u2014 affecting the entire filesystem and not just the attacker\u0027s own file, repairable only by fsck.\\nA:H - After the unclean mount, `f2fs_sanity_check_ckpt()` rejects the volume with \\\"Wrong valid_user_blocks\\\" (`-EFSCORRUPTED`), rendering an f2fs root or `/data` unmountable and the device unbootable; `dec_valid_block_count()`\u0027s `f2fs_bug_on(sbi, sbi-\u003etotal_valid_block_count \u003c count)` also yields a `BUG_ON` kernel panic under `CONFIG_F2FS_CHECK_FS`, with `SBI_NEED_FSCK`/forced read-only otherwise.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"a6e1f7744e9b84f86a629a76024bba8468aa153b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"b5bac43875aa27ec032dbbb86173baae6dce6182\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"5d47d63883735718825ca2efc4fca6915469774f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"69136304fd144144a4828c7b7b149d0f80321ba4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef8d563f184e1112651f2cbde383d43e599334e8\", \"lessThan\": \"0a4ed2d97cb6d044196cc3e726b6699222b41019\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b\"}, {\"url\": \"https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182\"}, {\"url\": \"https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f\"}, {\"url\": \"https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b\"}, {\"url\": \"https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4\"}, {\"url\": \"https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\n\\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\\nto avoid racing with checkpoint, otherwise, filesystem metadata including\\nblkaddr in dnode, inode fields and .total_valid_block_count may be\\ncorrupted after SPO case.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.4\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:52.924Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-34027\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:52.924Z\", \"dateReserved\": \"2024-06-24T13:54:11.051Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-24T13:56:49.389Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.