CVE-2024-27034: Vulnerability in linux-libc-dev package - f2fs: compress: fix to cover normal cluster write with cp_rwsem
Summary
CVE-2024-27034: In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem du... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability in the linux-libc-dev package is related to the f2fs (Flash-Friendly File System) module in the Linux kernel. The issue arises when overwriting a compressed cluster with a normal cluster. During the f2fs_write_raw_pages() function, the cp_rwsem (checkpoint read-write semaphore) is unlocked, which can lead to data corruption if partial blocks were persisted before the checkpoint and SPOR (Sudden Power-Off Recovery). This occurs because the cluster metadata is not updated atomically. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by following best practices for system security, such as implementing proper access controls, regularly updating software, and monitoring for any suspicious activity.
Conclusion
The linux-libc-dev package is vulnerable to a medium severity issue related to the f2fs module in the Linux kernel. It is recommended to update the package to a version that includes the fix for the f2fs compress vulnerability. Regularly updating packages and following best practices for system security can help mitigate the risk of such vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems.
f2fs (Flash-Friendly File System) is a file system designed for NAND-based flash storage devices. It is optimized for flash memory characteristics and aims to provide high performance and reliability.
The vulnerability can lead to data corruption if partial blocks were persisted before the checkpoint and SPOR. It could potentially result in the loss or manipulation of data stored on the affected system.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Users can update the linux-libc-dev package by obtaining the latest version from the official Debian repositories or through the package management system of their Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
