CVE-2024-27032CWE-835

CVE-2024-27032

Medium · published May 1, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid potential panic during recovery

During recovery, if FAULT_BLOCK is on, it is possible that

f2fs_reserve_new_block() will return -ENOSPC during recovery,

then it may trigger panic.

Also, if fault injection rate is 1 and only FAULT_BLOCK fault

type is on, it may encounter deadloop in loop of block reservation.

Let's change as below to fix these issues:

- remove bug_on() to avoid panic.

- limit the loop count of block reservation to avoid potential

deadloop.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2024-05-01T17:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 4.19.307, < 4.204.20
linux/linux_kernel≥ 5.4.269, < 5.55.5
linux/linux_kernel≥ 5.10.210, < 5.115.11
linux/linux_kernel≥ 5.15.149, < 5.165.16
linux/linux_kernel≥ 6.1.77, < 6.1.836.1.83
linux/linux_kernel≥ 6.6.16, < 6.6.236.6.23
linux/linux_kernel≥ 6.7.4, < 6.7.116.7.11
linux/linux_kernel≥ 6.8, < 6.8.26.8.2
References (11)
EPSS history
Timeline
  • 01 MAY 12:53Z
    f2fs: fix to avoid potential panic during recovery
    cvelistv5