Critical Vulnerability in Linux Kernel: f2fs Discard Command Issue
Summary
CVE-2024-56565: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all discards after creating snapshot on lvm device Piergiorgio reported a bug in bugzilla as below: ------------[ cut here ]----------... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The f2fs (Flash-Friendly File System) is designed to optimize performance on flash storage devices. This vulnerability affects the f2fs implementation within the Linux kernel, specifically when handling discard commands after creating snapshots on LVM (Logical Volume Manager) devices.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the f2fs file system where the discard_max_bytes parameter is incorrectly set to zero after creating a snapshot on an LVM device. This leads to the __submit_discard_cmd function passing a zero value to __blkdev_issue_discard, resulting in a NULL bio pointer and causing a system panic. The vulnerability can be triggered through a specific sequence of commands, which may lead to system instability and data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid creating snapshots on LVM devices with f2fs mounted until the patch is applied. Additionally, users can manually drop all remaining discards in f2fs_unfreeze if a snapshot is created.
Conclusion
The CVE-2024-56565 vulnerability in the Linux kernel's f2fs file system poses a significant risk, particularly for users operating on LVM devices. It is crucial to apply the necessary updates to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system panic and potential data loss when using f2fs on LVM devices.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, updating to the patched version of the Linux package will resolve the vulnerability.
As a temporary measure, avoid creating snapshots on LVM devices with f2fs mounted.
Detailed information can be found in the CVE report for CVE-2024-56565.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
