{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42296","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-30T07:40:12.269Z","datePublished":"2024-08-17T09:09:04.429Z","dateUpdated":"2026-08-05T11:36:26.647Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:36:26.647Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix return value of f2fs_convert_inline_inode()\n\nIf device is readonly, make f2fs_convert_inline_inode()\nreturn EROFS instead of zero, otherwise it may trigger\npanic during writeback of inline inode's dirty page as\nbelow:\n\n f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888\n f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369\n do_writepages+0x359/0x870 mm/page-writeback.c:2634\n filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397\n __filemap_fdatawrite_range mm/filemap.c:430 [inline]\n file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788\n f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276\n generic_write_sync include/linux/fs.h:2806 [inline]\n f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977\n call_write_iter include/linux/fs.h:2114 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xa72/0xc90 fs/read_write.c:590\n ksys_write+0x1a0/0x2c0 fs/read_write.c:643\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached entirely through local filesystem syscalls — `write()`/`fsync()` or an `mmap(MAP_SHARED)` store — against a file on a locally mounted f2fs. No network or physical component is involved in triggering it.\nAC:L - Once the f2fs is in the affected state (backing device read-only while mounted rw — a real steady state on wear-out eMMC/UFS, write-protected SD/USB media, RO dm tables, or a multi-device f2fs with one RO member), the trigger is deterministic and single-threaded: create a file small enough to stay inline, then mmap-write it or write past `MAX_INLINE_DATA` and fsync. There is no race to win and no memory layout to groom, and the attacker can repeat it at will.\nPR:L - Any unprivileged local user holding a writable fd to a file on the affected f2fs — their own file in a home directory, /tmp, or /data/local/tmp — can reach both `f2fs_vm_page_mkwrite()` and the writeback path. No capability, ioctl gate, or mount privilege is required.\nUI:N - No victim action is needed; the attacker performs the write or page fault entirely on their own file. The read-only device condition is a pre-existing system/hardware state, not an interaction solicited from a user.\nS:U - The BUG_ON, the corrupted `i_addr[]`/inline region, and any resulting data access all live inside the kernel and the same f2fs instance. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The resulting inode state (F2FS_INLINE_DATA set with real block addresses in the overlapping `i_addr[]` array) is the same corruption class as CVE-2024-44942; on-disk block addresses become readable as file content, and once the inline flag is cleared via `f2fs_convert_inline_page()`'s `clear_out` path without truncating the region, the user controls their file's block map and can read data blocks belonging to other files on the filesystem.\nI:H - `f2fs_get_block_locked()` stamps block addresses over the inline data area while `f2fs_write_inline_data()`'s `memcpy_from_page()` stamps user-controlled bytes over the block address array, giving mutually corrupting writes to inode metadata; on a multi-device f2fs with one RO member the rest of the volume stays writable, so this inconsistent inode can be committed to disk and later drive GC/truncate down attacker-influenced block addresses.\nA:H - The commit states it \"may trigger panic,\" and the shared syzbot report shows `kernel BUG at fs/f2fs/inline.c:258` in `f2fs_write_inline_data()`; with CONFIG_F2FS_CHECK_FS the `f2fs_bug_on()` at fs/f2fs/file.c:105 and fs/f2fs/inline.c:258 are BUG_ON, and without it the WARN_ON panics under panic_on_warn and otherwise leaves the filesystem flagged NEED_FSCK."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/inline.c"],"versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"70f5ef5f33c333cfb286116fa3af74ac9bc84f1b","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"47a8ddcdcaccd9b891db4574795e46a33a121ac2","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"077f0e24b27c4b44841593c7edbd1993be9eecb5","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"1e7725814361c8c008d131db195cef8274ff26b8","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"a8eb3de28e7a365690c61161e7a07a4fc7c60bbf","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/inline.c"],"versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","status":"unaffected","versionType":"semver"},{"version":"5.15.165","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.103","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.44","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.3","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.15.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.10.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/70f5ef5f33c333cfb286116fa3af74ac9bc84f1b"},{"url":"https://git.kernel.org/stable/c/47a8ddcdcaccd9b891db4574795e46a33a121ac2"},{"url":"https://git.kernel.org/stable/c/077f0e24b27c4b44841593c7edbd1993be9eecb5"},{"url":"https://git.kernel.org/stable/c/1e7725814361c8c008d131db195cef8274ff26b8"},{"url":"https://git.kernel.org/stable/c/a8eb3de28e7a365690c61161e7a07a4fc7c60bbf"}],"title":"f2fs: fix return value of f2fs_convert_inline_inode()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42296","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:10:47.727572Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T17:33:28.998Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T22:03:55.469Z"}}]}}