GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47691 (GCVE-0-2024-47691)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:38
VLAI
Title
f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() syzbot reports a f2fs bug as below: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_report+0xe8/0x550 mm/kasan/report.c:491 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:184 [inline] __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] get_task_struct include/linux/sched/task.h:118 [inline] kthread_stop+0xca/0x630 kernel/kthread.c:704 f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210 f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283 f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline] __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is below race condition, it may cause use-after-free issue in sbi->gc_th pointer. - remount - f2fs_remount - f2fs_stop_gc_thread - kfree(gc_th) - f2fs_ioc_shutdown - f2fs_do_shutdown - f2fs_stop_gc_thread - kthread_stop(gc_th->f2fs_gc_task) : sbi->gc_thread = NULL; We will call f2fs_do_shutdown() in two paths: - for f2fs_ioc_shutdown() path, we should grab sb->s_umount semaphore for fixing. - for f2fs_shutdown() path, it's safe since caller has already grabbed sb->s_umount semaphore.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7950e9ac638e84518fbdd5c930939ad46a1068c5 , < fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812 (git)
Affected: 7950e9ac638e84518fbdd5c930939ad46a1068c5 , < 7c339dee7eb0f8e4cadc317c595f898ef04dae30 (git)
Affected: 7950e9ac638e84518fbdd5c930939ad46a1068c5 , < d79343cd66343709e409d96b2abb139a0a55ce34 (git)
Affected: 7950e9ac638e84518fbdd5c930939ad46a1068c5 , < c7f114d864ac91515bb07ac271e9824a20f5ed95 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:05:54.447851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:15.179Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/file.c",
            "fs/f2fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812",
              "status": "affected",
              "version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
              "versionType": "git"
            },
            {
              "lessThan": "7c339dee7eb0f8e4cadc317c595f898ef04dae30",
              "status": "affected",
              "version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
              "versionType": "git"
            },
            {
              "lessThan": "d79343cd66343709e409d96b2abb139a0a55ce34",
              "status": "affected",
              "version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
              "versionType": "git"
            },
            {
              "lessThan": "c7f114d864ac91515bb07ac271e9824a20f5ed95",
              "status": "affected",
              "version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/file.c",
            "fs/f2fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\n\nsyzbot reports a f2fs bug as below:\n\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_report+0xe8/0x550 mm/kasan/report.c:491\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\n __refcount_add include/linux/refcount.h:184 [inline]\n __refcount_inc include/linux/refcount.h:241 [inline]\n refcount_inc include/linux/refcount.h:258 [inline]\n get_task_struct include/linux/sched/task.h:118 [inline]\n kthread_stop+0xca/0x630 kernel/kthread.c:704\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is below race condition, it may cause use-after-free\nissue in sbi-\u003egc_th pointer.\n\n- remount\n - f2fs_remount\n  - f2fs_stop_gc_thread\n   - kfree(gc_th)\n\t\t\t\t- f2fs_ioc_shutdown\n\t\t\t\t - f2fs_do_shutdown\n\t\t\t\t  - f2fs_stop_gc_thread\n\t\t\t\t   - kthread_stop(gc_th-\u003ef2fs_gc_task)\n   : sbi-\u003egc_thread = NULL;\n\nWe will call f2fs_do_shutdown() in two paths:\n- for f2fs_ioc_shutdown() path, we should grab sb-\u003es_umount semaphore\nfor fixing.\n- for f2fs_shutdown() path, it\u0027s safe since caller has already grabbed\nsb-\u003es_umount semaphore."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:38:53.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c339dee7eb0f8e4cadc317c595f898ef04dae30"
        },
        {
          "url": "https://git.kernel.org/stable/c/d79343cd66343709e409d96b2abb139a0a55ce34"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95"
        }
      ],
      "title": "f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47691",
    "datePublished": "2024-10-21T11:53:30.555Z",
    "dateReserved": "2024-09-30T16:00:12.942Z",
    "dateUpdated": "2026-05-11T20:38:53.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47691",
      "date": "2026-09-17",
      "epss": "0.00237",
      "percentile": "0.14963"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:01:06.000Z",
      "cve": "CVE-2024-47691",
      "id": "msrc_CVE-2024-47691",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47691.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47691\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:05.880\",\"lastModified\":\"2026-06-17T07:57:33.040\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\\n\\nsyzbot reports a f2fs bug as below:\\n\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n print_report+0xe8/0x550 mm/kasan/report.c:491\\n kasan_report+0x143/0x180 mm/kasan/report.c:601\\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\\n __refcount_add include/linux/refcount.h:184 [inline]\\n __refcount_inc include/linux/refcount.h:241 [inline]\\n refcount_inc include/linux/refcount.h:258 [inline]\\n get_task_struct include/linux/sched/task.h:118 [inline]\\n kthread_stop+0xca/0x630 kernel/kthread.c:704\\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\\n vfs_ioctl fs/ioctl.c:51 [inline]\\n __do_sys_ioctl fs/ioctl.c:907 [inline]\\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nThe root cause is below race condition, it may cause use-after-free\\nissue in sbi-\u003egc_th pointer.\\n\\n- remount\\n - f2fs_remount\\n  - f2fs_stop_gc_thread\\n   - kfree(gc_th)\\n\\t\\t\\t\\t- f2fs_ioc_shutdown\\n\\t\\t\\t\\t - f2fs_do_shutdown\\n\\t\\t\\t\\t  - f2fs_stop_gc_thread\\n\\t\\t\\t\\t   - kthread_stop(gc_th-\u003ef2fs_gc_task)\\n   : sbi-\u003egc_thread = NULL;\\n\\nWe will call f2fs_do_shutdown() in two paths:\\n- for f2fs_ioc_shutdown() path, we should grab sb-\u003es_umount semaphore\\nfor fixing.\\n- for f2fs_shutdown() path, it\u0027s safe since caller has already grabbed\\nsb-\u003es_umount semaphore.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para evitar el use after free en f2fs_stop_gc_thread() syzbot informa un error de f2fs como el siguiente: __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_report+0xe8/0x550 mm/kasan/report.c:491 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [en l\u00ednea] atomic_fetch_add_relaxed incluir/linux/atomic/atomic-instrumented.h:252 [en l\u00ednea] __refcount_add incluir/linux/refcount.h:184 [en l\u00ednea] __refcount_inc incluir/linux/refcount.h:241 [en l\u00ednea] refcount_inc incluir/linux/refcount.h:258 [en l\u00ednea] obtener_estructura_de_tareas incluir/linux/sched/task.h:118 [en l\u00ednea] kthread_stop+0xca/0x630 kernel/kthread.c:704 f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210 f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283 f2fs_ioc_shutdown fs/f2fs/file.c:2325 [en l\u00ednea] __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325 vfs_ioctl fs/ioctl.c:51 [en l\u00ednea] __do_sys_ioctl fs/ioctl.c:907 [en l\u00ednea] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f La causa ra\u00edz est\u00e1 a continuaci\u00f3n de la condici\u00f3n de ejecuci\u00f3n, puede causar un problema de use after free en el puntero sbi-\u0026gt;gc_th. - remontar - f2fs_remount - f2fs_stop_gc_thread - kfree(gc_th) - f2fs_ioc_shutdown - f2fs_do_shutdown - f2fs_stop_gc_thread - kthread_stop(gc_th-\u0026gt;f2fs_gc_task) : sbi-\u0026gt;gc_thread = NULL; Llamaremos a f2fs_do_shutdown() en dos rutas: - para la ruta f2fs_ioc_shutdown(), debemos tomar el sem\u00e1foro sb-\u0026gt;s_umount para arreglarlo. - para la ruta f2fs_shutdown(), es seguro ya que el llamador ya ha tomado el sem\u00e1foro sb-\u0026gt;s_umount.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/f2fs.h\",\"fs/f2fs/file.c\",\"fs/f2fs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7950e9ac638e84518fbdd5c930939ad46a1068c5\",\"lessThan\":\"fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7950e9ac638e84518fbdd5c930939ad46a1068c5\",\"lessThan\":\"7c339dee7eb0f8e4cadc317c595f898ef04dae30\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7950e9ac638e84518fbdd5c930939ad46a1068c5\",\"lessThan\":\"d79343cd66343709e409d96b2abb139a0a55ce34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7950e9ac638e84518fbdd5c930939ad46a1068c5\",\"lessThan\":\"c7f114d864ac91515bb07ac271e9824a20f5ed95\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/f2fs.h\",\"fs/f2fs/file.c\",\"fs/f2fs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:05:54.447851Z\",\"id\":\"CVE-2024-47691\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"955B9A45-6500-43F0-BFD6-27ED37A0DC7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7c339dee7eb0f8e4cadc317c595f898ef04dae30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d79343cd66343709e409d96b2abb139a0a55ce34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:22:14+00:00",
      "cve": "CVE-2024-47691",
      "id": "CVE-2024-47691",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47691.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47691\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:05:54.447851Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:05:57.761Z\"}}], \"cna\": {\"title\": \"f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7950e9ac638e84518fbdd5c930939ad46a1068c5\", \"lessThan\": \"fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7950e9ac638e84518fbdd5c930939ad46a1068c5\", \"lessThan\": \"7c339dee7eb0f8e4cadc317c595f898ef04dae30\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7950e9ac638e84518fbdd5c930939ad46a1068c5\", \"lessThan\": \"d79343cd66343709e409d96b2abb139a0a55ce34\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7950e9ac638e84518fbdd5c930939ad46a1068c5\", \"lessThan\": \"c7f114d864ac91515bb07ac271e9824a20f5ed95\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/f2fs.h\", \"fs/f2fs/file.c\", \"fs/f2fs/super.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/f2fs.h\", \"fs/f2fs/file.c\", \"fs/f2fs/super.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812\"}, {\"url\": \"https://git.kernel.org/stable/c/7c339dee7eb0f8e4cadc317c595f898ef04dae30\"}, {\"url\": \"https://git.kernel.org/stable/c/d79343cd66343709e409d96b2abb139a0a55ce34\"}, {\"url\": \"https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\\n\\nsyzbot reports a f2fs bug as below:\\n\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n print_report+0xe8/0x550 mm/kasan/report.c:491\\n kasan_report+0x143/0x180 mm/kasan/report.c:601\\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\\n __refcount_add include/linux/refcount.h:184 [inline]\\n __refcount_inc include/linux/refcount.h:241 [inline]\\n refcount_inc include/linux/refcount.h:258 [inline]\\n get_task_struct include/linux/sched/task.h:118 [inline]\\n kthread_stop+0xca/0x630 kernel/kthread.c:704\\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\\n vfs_ioctl fs/ioctl.c:51 [inline]\\n __do_sys_ioctl fs/ioctl.c:907 [inline]\\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nThe root cause is below race condition, it may cause use-after-free\\nissue in sbi-\u003egc_th pointer.\\n\\n- remount\\n - f2fs_remount\\n  - f2fs_stop_gc_thread\\n   - kfree(gc_th)\\n\\t\\t\\t\\t- f2fs_ioc_shutdown\\n\\t\\t\\t\\t - f2fs_do_shutdown\\n\\t\\t\\t\\t  - f2fs_stop_gc_thread\\n\\t\\t\\t\\t   - kthread_stop(gc_th-\u003ef2fs_gc_task)\\n   : sbi-\u003egc_thread = NULL;\\n\\nWe will call f2fs_do_shutdown() in two paths:\\n- for f2fs_ioc_shutdown() path, we should grab sb-\u003es_umount semaphore\\nfor fixing.\\n- for f2fs_shutdown() path, it\u0027s safe since caller has already grabbed\\nsb-\u003es_umount semaphore.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:37:28.674Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47691\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:37:28.674Z\", \"dateReserved\": \"2024-09-30T16:00:12.942Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:30.555Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.