CVE-2024-35844: linux-libc-dev - f2fs: compress: fix reserve_cblocks counting error when out of space
Summary
CVE-2024-35844: In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix reserve_cblocks counting error when out of space When a file only needs one direct_node, performing the following operations will ca... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The vulnerability identified as CVE-2024-35844 affects the linux-libc-dev package, specifically in the f2fs (Flash-Friendly File System) module. F2FS is a file system designed for NAND-based flash storage devices, offering improved performance and reliability. This vulnerability can lead to file corruption and an inability to repair affected files.
Vulnerability Detail
The vulnerability in the f2fs module of the linux-libc-dev package arises from a counting error in the reserve_cblocks function when the file system runs out of space. If a file only requires one direct_node and certain operations are performed, such as compressing the file, releasing cblocks, and reserving cblocks, the file can become unrepairable. This occurs because the reserved_blocks variable is not properly incremented after returning -ENOSPC (no space left on device) error, resulting in an incorrect count of reserved blocks. As a consequence, the file cannot be repaired by the fsck (file system check) utility. The impact of this vulnerability is the potential loss or corruption of files stored on the affected file system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the linux-libc-dev package to the patched version.
Conclusion
The vulnerability in the linux-libc-dev package's f2fs module can result in file corruption and an inability to repair affected files. It is recommended to update the package to version 6.1.90-1 or later to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package is a development package that provides header files and libraries for compiling C programs that use Linux kernel interfaces. It is necessary for building and running applications on Linux systems.
The f2fs (Flash-Friendly File System) module is a file system designed for NAND-based flash storage devices. It offers improved performance and reliability compared to traditional file systems.
This vulnerability can lead to file corruption and an inability to repair affected files. If a file only requires one direct_node and certain operations are performed, the file can become unrepairable.
To fix this vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later. This update includes a patch that addresses the counting error in the f2fs module.
There is no known workaround for this vulnerability. It is crucial to apply the provided fix by updating the linux-libc-dev package.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
