Critical Vulnerability in Linux Package: f2fs Discard Command Panic
Summary
DEBIAN-CVE-2024-56565: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all discards after creating snapshot on lvm device Piergiorgio reported a bug in bugzilla as below: ------------[ cut here ]----------... Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used in various environments, including servers and personal computers. This package supports multiple file systems, including f2fs, which is designed for flash storage. The vulnerability in question affects the f2fs file system, specifically when creating snapshots on LVM devices, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the f2fs file system that can cause a system panic. This issue arises when a snapshot is created on an LVM device, which inadvertently sets the discard_max_bytes of the mounted device to zero. Consequently, the __submit_discard_cmd function attempts to pass a zero value to __blkdev_issue_discard, resulting in a NULL bio pointer and ultimately causing a panic. This vulnerability was reported by Piergiorgio in a bug report, highlighting its critical nature and the potential for system instability.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid creating snapshots on LVM devices with f2fs until the package is updated. This can prevent the panic from occurring while a permanent fix is being implemented.
Conclusion
The vulnerability in the Linux package related to the f2fs file system poses a significant risk of system panic when creating snapshots on LVM devices. It is crucial to update to the patched version 6.12.5-1 to mitigate this risk. Users are advised to refrain from using snapshots until the update is applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability causes a system panic when creating snapshots on LVM devices using the f2fs file system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failure to address this vulnerability may lead to system crashes and instability, especially when using f2fs with LVM snapshots.
Yes, the vulnerability is fixed in version 6.12.5-1 of the Linux package for both Debian 13 and Debian 14.
If an immediate update is not possible, avoid creating snapshots on LVM devices with f2fs to prevent triggering the panic.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
