CVE-2024-47740

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47740
In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac Patch
https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713 Patch
https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d Patch
https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece Patch
https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e Patch
https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731 Patch
https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 Patch
https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac Patch
https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

08 Oct 2025, 17:03

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac - () https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac - Patch
References () https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713 - () https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713 - Patch
References () https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d - () https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d - Patch
References () https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece - () https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece - Patch
References () https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e - () https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e - Patch
References () https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731 - () https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731 - Patch
References () https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 - () https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 - Patch
References () https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac - () https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac - Patch
References () https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d - () https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d - Patch

08 Nov 2024, 16:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece -
  • () https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: Requerir FMODE_WRITE para ioctls de escritura atómica Los ioctls de F2FS para iniciar y confirmar escrituras atómicas comprueban inode_owner_or_capable(), pero esto no da a los LSM como SELinux o Landlock la oportunidad de denegar el acceso de escritura: si el FSUID del llamador coincide con el UID del inodo, inode_owner_or_capable() devuelve verdadero inmediatamente. Hay escenarios en los que los LSM quieren denegar a un proceso la capacidad de escribir archivos particulares, incluso archivos que el FSUID del proceso posee; pero esto actualmente se puede omitir parcialmente usando ioctls de escritura atómica de dos maneras: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE puede truncar un inodo a tamaño 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE puede revertir los cambios que otro proceso realizó simultáneamente en un archivo Arréglelo requiriendo FMODE_WRITE para estas operaciones, al igual que para F2FS_IOC_MOVE_RANGE. Dado que cualquier llamador legítimo solo debe usar estos ioctls cuando tenga la intención de escribir en el archivo, parece poco probable que eso rompa algo.

21 Oct 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 13:15

Updated : 2025-10-08 17:03

NVD link : CVE-2024-47740

Mitre link : CVE-2024-47740

CVE.ORG link : CVE-2024-47740

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo