CVE-2024-56565

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56565
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all discards after creating snapshot on lvm device Piergiorgio reported a bug in bugzilla as below: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330 RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs] Call Trace: __issue_discard_cmd+0x1ca/0x350 [f2fs] issue_discard_thread+0x191/0x480 [f2fs] kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 w/ below testcase, it can reproduce this bug quickly: - pvcreate /dev/vdb - vgcreate myvg1 /dev/vdb - lvcreate -L 1024m -n mylv1 myvg1 - mount /dev/myvg1/mylv1 /mnt/f2fs - dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20 - sync - rm /mnt/f2fs/file - sync - lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1 - umount /mnt/f2fs The root cause is: it will update discard_max_bytes of mounted lvm device to zero after creating snapshot on this lvm device, then, __submit_discard_cmd() will pass parameter @nr_sects w/ zero value to __blkdev_issue_discard(), it returns a NULL bio pointer, result in panic. This patch changes as below for fixing: 1. Let's drop all remained discards in f2fs_unfreeze() if snapshot of lvm device is created. 2. Checking discard_max_bytes before submitting discard during __submit_discard_cmd().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2 Patch
https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e Patch
https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Oct 2025, 18:34

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2 - () https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2 - Patch
References () https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e - () https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e - Patch
References () https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22 - () https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrección para descartar todos los descartes después de crear una instantánea en el dispositivo lvm Piergiorgio informó un error en bugzilla como se muestra a continuación: ------------[ cortar aquí ]------------ ADVERTENCIA: CPU: 2 PID: 969 en fs/f2fs/segment.c:1330 RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs] Seguimiento de llamadas: __issue_discard_cmd+0x1ca/0x350 [f2fs] issue_discard_thread+0x191/0x480 [f2fs] kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 con el siguiente caso de prueba, puede reproducir este error rápidamente: - pvcreate /dev/vdb - vgcreate myvg1 /dev/vdb - lvcreate -L 1024m -n mylv1 myvg1 - mount /dev/myvg1/mylv1 /mnt/f2fs - dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20 - sync - rm /mnt/f2fs/file - sync - lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1 - umount /mnt/f2fs La causa raíz es: actualizará discard_max_bytes del dispositivo lvm montado a cero después de crear una instantánea en este dispositivo lvm, luego, __submit_discard_cmd() pasará el parámetro @nr_sects con valor cero a __blkdev_issue_discard(), devuelve un puntero bio NULL, resultado En pánico. Este parche cambia lo siguiente para solucionar: 1. Descartamos todos los descartes restantes en f2fs_unfreeze() si se crea una instantánea del dispositivo lvm. 2. Comprobamos discard_max_bytes antes de enviar el descarte durante __submit_discard_cmd().
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-10-07 18:34

NVD link : CVE-2024-56565

Mitre link : CVE-2024-56565

CVE.ORG link : CVE-2024-56565

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo