CVE-2024-34027

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-34027", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-24T13:54:11.051Z", "datePublished": "2024-06-24T13:56:49.389Z", "dateUpdated": "2026-10-15T00:40:44.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:52.924Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the `F2FS_IOC_RELEASE_COMPRESS_BLOCKS` / `F2FS_IOC_RESERVE_COMPRESS_BLOCKS` ioctls issued on a local file descriptor of a mounted f2fs volume. There is no remote or network-facing path into `f2fs_{release,reserve}_compress_blocks()`.\nAC:L - The attacker drives both sides of the race \u2014 one thread loops the compress-block ioctls while another loops unprivileged `syncfs()`, which calls `f2fs_sync_fs(sb, 1)` \u2192 `f2fs_issue_checkpoint()`, so the racing checkpoint is attacker-scheduled rather than incidental. Once won, the inconsistent metadata is written to persistent storage and stays there, and f2fs compression is broadly deployed (Android GKI enables `CONFIG_F2FS_FS_COMPRESSION`), so no condition outside the attacker's influence is needed to reach the corrupt state.\nPR:L - Both ioctls carry no `capable()` or `CAP_SYS_ADMIN` check \u2014 unlike the adjacent `F2FS_IOC_RESIZE_FS`/`GARBAGE_COLLECT` handlers \u2014 and setting `FS_COMPR_FL` requires only `inode_owner_or_capable`. Any unprivileged local user with a file on a rw-mounted compression-enabled f2fs volume can create a compressed file and invoke them.\nUI:N - The attacker operates entirely on a file it creates and owns on an already-mounted filesystem, in a self-contained two-thread loop. No action by any other user or administrator is required.\nS:U - The corruption is confined to the f2fs filesystem metadata managed by the same kernel security authority that hosts the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The persisted mismatch between inode compress accounting (`i_blocks`, `i_compr_blocks`, `FI_COMPRESS_RELEASED`) and the dnode blkaddr layout means a compressed cluster can be decompressed using a block count that no longer matches its real extent, surfacing content of blocks outside the file \u2014 a cross-file disclosure on a shared volume, which is why the fs is flagged `SBI_NEED_FSCK` rather than merely losing space.\nI:H - An unprivileged user achieves persistent, unauthorized corruption of shared on-disk filesystem metadata \u2014 dnode block addresses, inode `i_blocks`/`i_compr_blocks`, and the volume-global `total_valid_block_count` \u2014 affecting the entire filesystem and not just the attacker's own file, repairable only by fsck.\nA:H - After the unclean mount, `f2fs_sanity_check_ckpt()` rejects the volume with \"Wrong valid_user_blocks\" (`-EFSCORRUPTED`), rendering an f2fs root or `/data` unmountable and the device unbootable; `dec_valid_block_count()`'s `f2fs_bug_on(sbi, sbi->total_valid_block_count < count)` also yields a `BUG_ON` kernel panic under `CONFIG_F2FS_CHECK_FS`, with `SBI_NEED_FSCK`/forced read-only otherwise."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/file.c"], "versions": [{"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "a6e1f7744e9b84f86a629a76024bba8468aa153b", "status": "affected", "versionType": "git"}, {"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "b5bac43875aa27ec032dbbb86173baae6dce6182", "status": "affected", "versionType": "git"}, {"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "5d47d63883735718825ca2efc4fca6915469774f", "status": "affected", "versionType": "git"}, {"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b", "status": "affected", "versionType": "git"}, {"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "69136304fd144144a4828c7b7b149d0f80321ba4", "status": "affected", "versionType": "git"}, {"version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "0a4ed2d97cb6d044196cc3e726b6699222b41019", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/file.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.9.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"}, {"url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"}, {"url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"}, {"url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"}, {"url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"}, {"url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"}], "title": "f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "c75488fb4d82", "status": "affected", "lessThan": "a6e1f7744e9b", "versionType": "git"}, {"version": "c75488fb4d82", "status": "affected", "lessThan": "b5bac43875aa", "versionType": "git"}, {"version": "c75488fb4d82", "status": "affected", "lessThan": "5d47d6388373", "versionType": "git"}, {"version": "c75488fb4d82", "status": "affected", "lessThan": "329edb7c9e3b", "versionType": "git"}, {"version": "c75488fb4d82", "status": "affected", "lessThan": "69136304fd14", "versionType": "git"}, {"version": "c75488fb4d82", "status": "affected", "lessThan": "0a4ed2d97cb6", "versionType": "git"}, {"version": "5.8", "status": "affected"}, {"version": "0", "status": "affected", "lessThan": "5.8", "versionType": "semver"}, {"version": "5.10.219", "status": "affected", "lessThanOrEqual": "5.10*", "versionType": "semver"}, {"version": "6.1.93", "status": "affected", "lessThanOrEqual": "6.1*", "versionType": "semver"}, {"version": "6.6.33", "status": "affected", "lessThanOrEqual": "6.6*", "versionType": "semver"}, {"version": "6.94", "status": "affected", "lessThanOrEqual": "6.9*", "versionType": "semver"}, {"version": "6.10", "status": "affected", "lessThanOrEqual": "*", "versionType": "semver"}, {"version": "5.15.161", "status": "affected", "lessThanOrEqual": "5.15*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-05T14:50:20.784869Z", "id": "CVE-2024-34027", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T15:02:49.178Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.794Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:44.472Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.794Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:44.472Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34027", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-05T14:50:20.784869Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "c75488fb4d82", "lessThan": "a6e1f7744e9b", "versionType": "git"}, {"status": "affected", "version": "c75488fb4d82", "lessThan": "b5bac43875aa", "versionType": "git"}, {"status": "affected", "version": "c75488fb4d82", "lessThan": "5d47d6388373", "versionType": "git"}, {"status": "affected", "version": "c75488fb4d82", "lessThan": "329edb7c9e3b", "versionType": "git"}, {"status": "affected", "version": "c75488fb4d82", "lessThan": "69136304fd14", "versionType": "git"}, {"status": "affected", "version": "c75488fb4d82", "lessThan": "0a4ed2d97cb6", "versionType": "git"}, {"status": "affected", "version": "5.8"}, {"status": "affected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "affected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10*"}, {"status": "affected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1*"}, {"status": "affected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6*"}, {"status": "affected", "version": "6.94", "versionType": "semver", "lessThanOrEqual": "6.9*"}, {"status": "affected", "version": "6.10", "versionType": "semver", "lessThanOrEqual": "*"}, {"status": "affected", "version": "5.15.161", "versionType": "custom", "lessThanOrEqual": "5.15*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-25T13:24:40.353Z"}}], "cna": {"title": "f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the `F2FS_IOC_RELEASE_COMPRESS_BLOCKS` / `F2FS_IOC_RESERVE_COMPRESS_BLOCKS` ioctls issued on a local file descriptor of a mounted f2fs volume. There is no remote or network-facing path into `f2fs_{release,reserve}_compress_blocks()`.\nAC:L - The attacker drives both sides of the race \u2014 one thread loops the compress-block ioctls while another loops unprivileged `syncfs()`, which calls `f2fs_sync_fs(sb, 1)` \u2192 `f2fs_issue_checkpoint()`, so the racing checkpoint is attacker-scheduled rather than incidental. Once won, the inconsistent metadata is written to persistent storage and stays there, and f2fs compression is broadly deployed (Android GKI enables `CONFIG_F2FS_FS_COMPRESSION`), so no condition outside the attacker's influence is needed to reach the corrupt state.\nPR:L - Both ioctls carry no `capable()` or `CAP_SYS_ADMIN` check \u2014 unlike the adjacent `F2FS_IOC_RESIZE_FS`/`GARBAGE_COLLECT` handlers \u2014 and setting `FS_COMPR_FL` requires only `inode_owner_or_capable`. Any unprivileged local user with a file on a rw-mounted compression-enabled f2fs volume can create a compressed file and invoke them.\nUI:N - The attacker operates entirely on a file it creates and owns on an already-mounted filesystem, in a self-contained two-thread loop. No action by any other user or administrator is required.\nS:U - The corruption is confined to the f2fs filesystem metadata managed by the same kernel security authority that hosts the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The persisted mismatch between inode compress accounting (`i_blocks`, `i_compr_blocks`, `FI_COMPRESS_RELEASED`) and the dnode blkaddr layout means a compressed cluster can be decompressed using a block count that no longer matches its real extent, surfacing content of blocks outside the file \u2014 a cross-file disclosure on a shared volume, which is why the fs is flagged `SBI_NEED_FSCK` rather than merely losing space.\nI:H - An unprivileged user achieves persistent, unauthorized corruption of shared on-disk filesystem metadata \u2014 dnode block addresses, inode `i_blocks`/`i_compr_blocks`, and the volume-global `total_valid_block_count` \u2014 affecting the entire filesystem and not just the attacker's own file, repairable only by fsck.\nA:H - After the unclean mount, `f2fs_sanity_check_ckpt()` rejects the volume with \"Wrong valid_user_blocks\" (`-EFSCORRUPTED`), rendering an f2fs root or `/data` unmountable and the device unbootable; `dec_valid_block_count()`'s `f2fs_bug_on(sbi, sbi->total_valid_block_count < count)` also yields a `BUG_ON` kernel panic under `CONFIG_F2FS_CHECK_FS`, with `SBI_NEED_FSCK`/forced read-only otherwise."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "a6e1f7744e9b84f86a629a76024bba8468aa153b", "versionType": "git"}, {"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "b5bac43875aa27ec032dbbb86173baae6dce6182", "versionType": "git"}, {"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "5d47d63883735718825ca2efc4fca6915469774f", "versionType": "git"}, {"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b", "versionType": "git"}, {"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "69136304fd144144a4828c7b7b149d0f80321ba4", "versionType": "git"}, {"status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "lessThan": "0a4ed2d97cb6d044196cc3e726b6699222b41019", "versionType": "git"}], "programFiles": ["fs/f2fs/file.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/f2fs/file.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"}, {"url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"}, {"url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"}, {"url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"}, {"url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"}, {"url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.93", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.4", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "5.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:52.924Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34027", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:40:44.472Z", "dateReserved": "2024-06-24T13:54:11.051Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-24T13:56:49.389Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a6e1f7744e9b84f86a629a76024bba8468aa153b", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}, {"lessThan": "b5bac43875aa27ec032dbbb86173baae6dce6182", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}, {"lessThan": "5d47d63883735718825ca2efc4fca6915469774f", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}, {"lessThan": "329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}, {"lessThan": "69136304fd144144a4828c7b7b149d0f80321ba4", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}, {"lessThan": "0a4ed2d97cb6d044196cc3e726b6699222b41019", "status": "affected", "version": "ef8d563f184e1112651f2cbde383d43e599334e8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "a6e1f7744e9b", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"lessThan": "b5bac43875aa", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"lessThan": "5d47d6388373", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"lessThan": "329edb7c9e3b", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"lessThan": "69136304fd14", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"lessThan": "0a4ed2d97cb6", "status": "affected", "version": "c75488fb4d82", "versionType": "git"}, {"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10*", "status": "affected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "6.1*", "status": "affected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6*", "status": "affected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.9*", "status": "affected", "version": "6.94", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "affected", "version": "6.10", "versionType": "semver"}, {"lessThanOrEqual": "5.15*", "status": "affected", "version": "5.15.161", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3C0D860-7856-4982-83DA-17AFB1195E02", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31130639-53FE-4726-8986-434EE2528CB2", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEFB78EE-F990-4197-BF1C-156760A55667", "versionEndExcluding": "6.1.93", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "991B9791-966A-4D18-9E8D-A8AB128E5627", "versionEndExcluding": "6.9.4", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\n\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: compress: correcci\u00f3n para cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem Necesita cubrir {reserve,release}_compress_blocks() con bloqueo cp_rwsem para evitar ejecuciones con el punto de control; de lo contrario, los metadatos del sistema de archivos, incluido blkaddr en dnode, los campos de inodo y .total_valid_block_count, pueden da\u00f1arse despu\u00e9s del caso SPO."}], "id": "CVE-2024-34027", "lastModified": "2026-10-15T01:17:45.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-34027", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-05T14:50:20.784869Z", "version": "2.0.3"}}]}, "published": "2024-06-24T14:15:11.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d47d63883735718825ca2efc4fca6915469774f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69136304fd144144a4828c7b7b149d0f80321ba4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6e1f7744e9b84f86a629a76024bba8468aa153b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b5bac43875aa27ec032dbbb86173baae6dce6182"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock", "id": "2294216", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294216"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nf2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nIt needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock\nto avoid racing with checkpoint, otherwise, filesystem metadata including\nblkaddr in dnode, inode fields and .total_valid_block_count may be\ncorrupted after SPO case.", "A vulnerability was found in the Flash-Friendly File System (F2FS) in the Linux kernel, where the reserve_compress_blocks() and release_compress_blocks() functions were not adequately protected by the cp_rwsem lock. This locking deficiency could lead to race conditions, potentially causing data corruption or system instability when multiple processes access these functions concurrently. The issue has been addressed in a kernel update to ensure proper locking and prevent such race conditions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-34027", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-34027\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-34027\nhttps://lore.kernel.org/linux-cve-announce/2024062458-CVE-2024-34027-b9ea@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}