{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-40971","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-12T12:17:45.603Z","datePublished":"2024-07-12T12:32:09.440Z","dateUpdated":"2026-08-05T11:34:19.550Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:34:19.550Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this gap, these files\nwill not use inlinecrypt. Worse case, it may lead to data\ncorruption if wrappedkey_v0 is enable.\n\nThread A:                               Thread B:\n\n-f2fs_remount\t\t\t\t-f2fs_file_open or f2fs_new_inode\n  -default_options\n\t<- clear SB_INLINECRYPT flag\n\n                                          -fscrypt_select_encryption_impl\n\n  -parse_options\n\t<- set SB_INLINECRYPT again"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The affected code is reached exclusively through local syscalls — `mount(2)` remount on one side and `open(2)`/`creat(2)`/`mkdir(2)` on the other. No network protocol handler or remote peer data is involved.\nAC:L - There is no tight race to win: whenever the remount option string omits `inlinecrypt`, `SB_INLINECRYPT` stays cleared for the full duration of the remount (which includes multi-second work such as `f2fs_disable_checkpoint()`'s GC loop) or permanently on success, and the attacker simply runs a continuous file-creation loop, which is entirely under their control. f2fs remounts are routine, frequent system operations on the primary deployment (Android `/data`, embedded ro→rw transitions), not an extenuating circumstance.\nPR:L - The exploiting side — opening or creating files on the encrypted f2fs mount so they latch `ci_inlinecrypt = false` — requires only an ordinary unprivileged local account, with no capability check anywhere on the `f2fs_file_open()`/`f2fs_new_inode()` path. Only the environmental remount needs CAP_SYS_ADMIN, and that is a routine system action, not a privilege the attacker must hold.\nUI:N - The attacker performs their own file creations with no action required from another human; the remount is an automated system operation performed by init/vold/systemd during boot, user unlock, or OTA, not an interactive victim step.\nS:U - The mis-selected encryption implementation and the resulting corruption stay within the f2fs superblock and the kernel's own security authority. No VM, IOMMU, container, or sandbox boundary is crossed.\nC:L - The bug silently downgrades file-contents encryption from the inline crypto engine — where, with hardware-wrapped keys, key material never leaves the hardware key slots — to the software crypto API, materializing usable key material in kernel RAM on vendor kernels that permit the fallback and defeating the protection the `inlinecrypt` mount option was chosen to provide. Data is still encrypted on disk, so this is a limited weakening rather than an arbitrary read.\nI:H - Files created or opened while the flag is cleared are permanently bound to the wrong crypto implementation, so with `wrappedkey_v0` their contents are written under a different key than the one used on read-back, producing silent, persistent, unrecoverable corruption of user data on the encrypted partition — exactly the \"data corruption\" the fix commit describes. The corruption survives reboot and is not detectable or repairable by the affected application.\nA:H - On kernels with hardware-wrapped key support, `fscrypt_setup_v2_file_key()` returns `-EINVAL` for every regular-file open when inline crypt was not selected, so the entire encrypted data partition becomes inaccessible for the duration of the window — or indefinitely if the remount omitted `inlinecrypt` — rendering an Android/embedded device unusable. Corrupted system files on `/data` additionally force a factory reset to recover."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"],"versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"724429db09e21ee153fef35e34342279d33df6ae","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"a9cea0489c562c97cd56bb345e78939f9909e7f4","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"eddeb8d941d5be11a9da5637dbe81ac37e8449a2","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"ae39c8ec4250d2a35ddaab1c40faacfec306ff66","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"ac5eecf481c29942eb9a862e758c0c8b68090c33","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/super.c"],"versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","status":"unaffected","versionType":"semver"},{"version":"5.10.221","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.162","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.96","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.36","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9.7","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.10.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.15.162"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.9.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71"},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae"},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4"},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2"},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66"},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33"}],"title":"f2fs: remove clear SB_INLINECRYPT flag in default_options","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:58:36.200Z"}},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-40971","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:02:54.463850Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:22.540Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:56:00.292Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"unaffected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","versions":[{"status":"unaffected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","versions":[{"status":"unaffected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}]}]}}