CVE-2024-42273

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42273
In the Linux kernel, the following vulnerability has been resolved: f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid mkdir /mnt/test/comp f2fs_io setflags compression /mnt/test/comp dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile In the above scenario, we can get a BUG_ON. kernel BUG at fs/f2fs/segment.c:3589! Call Trace: do_write_page+0x78/0x390 [f2fs] f2fs_outplace_write_data+0x62/0xb0 [f2fs] f2fs_do_write_data_page+0x275/0x740 [f2fs] f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs] f2fs_write_multi_pages+0x1e5/0xae0 [f2fs] f2fs_write_cache_pages+0xab1/0xc60 [f2fs] f2fs_write_data_pages+0x2d8/0x330 [f2fs] do_writepages+0xcf/0x270 __writeback_single_inode+0x44/0x350 writeback_sb_inodes+0x242/0x530 __writeback_inodes_wb+0x54/0xf0 wb_writeback+0x192/0x310 wb_workfn+0x30d/0x400 The reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the page was set the gcing flag by set_cluster_dirty().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791 Patch
https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439 Patch
https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1 Patch
https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

02 Oct 2025, 18:30

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791 - () https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791 - Patch
References () https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439 - () https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439 - Patch
References () https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1 - () https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1 - Patch
References () https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1 - () https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1 - Patch

19 Aug 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: f2fs: asigna CURSEG_ALL_DATA_ATGC si blkaddr es válido mkdir /mnt/test/comp f2fs_io setflags compresión /mnt/test/comp dd if=/dev/zero of=/mnt/test/ comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile En el escenario anterior, podemos obtener un BUG_ON. ¡ERROR del kernel en fs/f2fs/segment.c:3589! Seguimiento de llamadas: do_write_page+0x78/0x390 [f2fs] f2fs_outplace_write_data+0x62/0xb0 [f2fs] f2fs_do_write_data_page+0x275/0x740 [f2fs] f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs_write_multi_ páginas+0x1e5/0xae0 [f2fs] f2fs_write_cache_páginas+0xab1/0xc60 [f2fs ] f2fs_write_data_pages+0x2d8/0x330 [f2fs] do_writepages+0xcf/0x270 __writeback_single_inode+0x44/0x350 writeback_sb_inodes+0x242/0x530 __writeback_inodes_wb+0x54/0xf0 wb_writeback+0x192/0x3 10 wb_workfn+0x30d/0x400 La razón es que le dimos CURSEG_ALL_DATA_ATGC a COMPR_ADDR donde está la página set_cluster_dirty() estableció la bandera gcing.

17 Aug 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-17 09:15

Updated : 2025-10-02 18:30

NVD link : CVE-2024-42273

Mitre link : CVE-2024-42273

CVE.ORG link : CVE-2024-42273

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo