GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49859 (GCVE-0-2024-49859)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:27 – Updated: 2026-08-05 11:40
VLAI
Title
f2fs: fix to check atomic_file in f2fs ioctl interfaces
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to check atomic_file in f2fs ioctl interfaces Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which may cause potential race issue, fix it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:55 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < 26b07bd2e1f124b0e430c8d250023f7205c549c3 (git)
Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < 7cb51731f24b216b0b87942f519f2c67a17107ee (git)
Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < 10569b682ebe9c75ef06ddd322ae844e9be6374b (git)
Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < d6f08c88047accc6127dddb6798a3ff11321539d (git)
Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < bfe5c02654261bfb8bd9cb174a67f3279ea99e58 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:55:54.448840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:10.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:28.562Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26b07bd2e1f124b0e430c8d250023f7205c549c3",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            },
            {
              "lessThan": "7cb51731f24b216b0b87942f519f2c67a17107ee",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            },
            {
              "lessThan": "10569b682ebe9c75ef06ddd322ae844e9be6374b",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            },
            {
              "lessThan": "d6f08c88047accc6127dddb6798a3ff11321539d",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            },
            {
              "lessThan": "bfe5c02654261bfb8bd9cb174a67f3279ea99e58",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check atomic_file in f2fs ioctl interfaces\n\nSome f2fs ioctl interfaces like f2fs_ioc_set_pin_file(),\nf2fs_move_file_range(), and f2fs_defragment_range() missed to\ncheck atomic_write status, which may cause potential race issue,\nfix it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local ioctl() calls (`F2FS_IOC_START_ATOMIC_WRITE`, `F2FS_IOC_MOVE_RANGE`, `F2FS_IOC_SET_PIN_FILE`, `F2FS_IOC_DEFRAGMENT`) on file descriptors of an already-mounted f2fs filesystem. There is no remote or adjacent-network path into `fs/f2fs/file.c`.\nAC:L - For the two unprivileged entry points no race is required at all \u2014 the attacker simply issues `F2FS_IOC_START_ATOMIC_WRITE` and then `F2FS_IOC_MOVE_RANGE`/`F2FS_IOC_SET_PIN_FILE` in sequence on the same fd, deterministically reaching the unguarded state. Even the `f2fs_defragment_range()` TOCTOU is driven entirely by two attacker-owned threads.\nPR:L - `f2fs_ioc_set_pin_file()` and `__f2fs_ioc_move_range()` contain no `capable()` check whatsoever, and `f2fs_ioc_start_atomic_write()` only requires `inode_owner_or_capable()` on a file the attacker creates \u2014 so any unprivileged local user with a writable f2fs mount (every Android app on `/data`, any automounted f2fs volume) can trigger it. Only the `F2FS_IOC_DEFRAGMENT` variant needs `CAP_SYS_ADMIN`, and it is not the limiting path.\nUI:N - The attacker performs every step themselves against an already-mounted filesystem; no victim needs to open a file, mount a volume, or take any other action.\nS:U - The corruption is confined to f2fs metadata and kernel memory within the same security authority \u2014 a standard local kernel compromise with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Double-release of a physical block desynchronizes SIT/SSA and the valid-block bitmaps, so a block still mapped in the attacker\u0027s inode is marked free and reallocated to another user\u0027s or system file, letting the attacker read its contents through their own mapping. The `SET_PIN_FILE` variant likewise drives in-place writes against stale extent-cache block addresses.\nI:H - The same double-referenced block gives the attacker a write primitive into another file\u0027s data, and the corrupted block accounting plus `f2fs_replace_block()` on stale/`NULL_ADDR` mappings persistently corrupts on-disk filesystem metadata (`SBI_NEED_FSCK`).\nA:H - The inconsistent state reaches `f2fs_bug_on()` in `f2fs_invalidate_blocks()`, `dec_valid_block_count()`, and `update_sit_entry()`, which are plain `BUG_ON` under `CONFIG_F2FS_CHECK_FS` \u2014 an immediate kernel panic \u2014 and otherwise leave the filesystem corrupted and unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:07.797Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26b07bd2e1f124b0e430c8d250023f7205c549c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cb51731f24b216b0b87942f519f2c67a17107ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/10569b682ebe9c75ef06ddd322ae844e9be6374b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6f08c88047accc6127dddb6798a3ff11321539d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfe5c02654261bfb8bd9cb174a67f3279ea99e58"
        }
      ],
      "title": "f2fs: fix to check atomic_file in f2fs ioctl interfaces",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49859",
    "datePublished": "2024-10-21T12:27:17.968Z",
    "dateReserved": "2024-10-21T12:17:06.017Z",
    "dateUpdated": "2026-08-05T11:40:07.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49859",
      "date": "2026-09-16",
      "epss": "0.00166",
      "percentile": "0.06188"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:42:02.000Z",
      "cve": "CVE-2024-49859",
      "id": "msrc_CVE-2024-49859",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: fix to check atomic_file in f2fs ioctl interfaces",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49859.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49859\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:06.627\",\"lastModified\":\"2026-08-04T11:20:51.820\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to check atomic_file in f2fs ioctl interfaces\\n\\nSome f2fs ioctl interfaces like f2fs_ioc_set_pin_file(),\\nf2fs_move_file_range(), and f2fs_defragment_range() missed to\\ncheck atomic_write status, which may cause potential race issue,\\nfix it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para verificar atomic_file en las interfaces ioctl de f2fs Algunas interfaces ioctl de f2fs como f2fs_ioc_set_pin_file(), f2fs_move_file_range() y f2fs_defragment_range() no pudieron verificar el estado de atomic_write, lo que puede causar un posible problema de ejecuci\u00f3n. Corr\u00edjalo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"26b07bd2e1f124b0e430c8d250023f7205c549c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"7cb51731f24b216b0b87942f519f2c67a17107ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"10569b682ebe9c75ef06ddd322ae844e9be6374b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"d6f08c88047accc6127dddb6798a3ff11321539d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"bfe5c02654261bfb8bd9cb174a67f3279ea99e58\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:55:54.448840Z\",\"id\":\"CVE-2024-49859\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"180292D6-C3A4-4883-98A3-77F4D56F8081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10569b682ebe9c75ef06ddd322ae844e9be6374b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/26b07bd2e1f124b0e430c8d250023f7205c549c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cb51731f24b216b0b87942f519f2c67a17107ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfe5c02654261bfb8bd9cb174a67f3279ea99e58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6f08c88047accc6127dddb6798a3ff11321539d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:04:17+00:00",
      "cve": "CVE-2024-49859",
      "id": "CVE-2024-49859",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix to check atomic_file in f2fs ioctl interfaces",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49859.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:28.562Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49859\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:55:54.448840Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:55:57.528Z\"}}], \"cna\": {\"title\": \"f2fs: fix to check atomic_file in f2fs ioctl interfaces\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached only through local ioctl() calls (`F2FS_IOC_START_ATOMIC_WRITE`, `F2FS_IOC_MOVE_RANGE`, `F2FS_IOC_SET_PIN_FILE`, `F2FS_IOC_DEFRAGMENT`) on file descriptors of an already-mounted f2fs filesystem. There is no remote or adjacent-network path into `fs/f2fs/file.c`.\\nAC:L - For the two unprivileged entry points no race is required at all \\u2014 the attacker simply issues `F2FS_IOC_START_ATOMIC_WRITE` and then `F2FS_IOC_MOVE_RANGE`/`F2FS_IOC_SET_PIN_FILE` in sequence on the same fd, deterministically reaching the unguarded state. Even the `f2fs_defragment_range()` TOCTOU is driven entirely by two attacker-owned threads.\\nPR:L - `f2fs_ioc_set_pin_file()` and `__f2fs_ioc_move_range()` contain no `capable()` check whatsoever, and `f2fs_ioc_start_atomic_write()` only requires `inode_owner_or_capable()` on a file the attacker creates \\u2014 so any unprivileged local user with a writable f2fs mount (every Android app on `/data`, any automounted f2fs volume) can trigger it. Only the `F2FS_IOC_DEFRAGMENT` variant needs `CAP_SYS_ADMIN`, and it is not the limiting path.\\nUI:N - The attacker performs every step themselves against an already-mounted filesystem; no victim needs to open a file, mount a volume, or take any other action.\\nS:U - The corruption is confined to f2fs metadata and kernel memory within the same security authority \\u2014 a standard local kernel compromise with no VM, IOMMU, or sandbox boundary crossed.\\nC:H - Double-release of a physical block desynchronizes SIT/SSA and the valid-block bitmaps, so a block still mapped in the attacker\u0027s inode is marked free and reallocated to another user\u0027s or system file, letting the attacker read its contents through their own mapping. The `SET_PIN_FILE` variant likewise drives in-place writes against stale extent-cache block addresses.\\nI:H - The same double-referenced block gives the attacker a write primitive into another file\u0027s data, and the corrupted block accounting plus `f2fs_replace_block()` on stale/`NULL_ADDR` mappings persistently corrupts on-disk filesystem metadata (`SBI_NEED_FSCK`).\\nA:H - The inconsistent state reaches `f2fs_bug_on()` in `f2fs_invalidate_blocks()`, `dec_valid_block_count()`, and `update_sit_entry()`, which are plain `BUG_ON` under `CONFIG_F2FS_CHECK_FS` \\u2014 an immediate kernel panic \\u2014 and otherwise leave the filesystem corrupted and unusable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"26b07bd2e1f124b0e430c8d250023f7205c549c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"7cb51731f24b216b0b87942f519f2c67a17107ee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"10569b682ebe9c75ef06ddd322ae844e9be6374b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"d6f08c88047accc6127dddb6798a3ff11321539d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\", \"lessThan\": \"bfe5c02654261bfb8bd9cb174a67f3279ea99e58\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/26b07bd2e1f124b0e430c8d250023f7205c549c3\"}, {\"url\": \"https://git.kernel.org/stable/c/7cb51731f24b216b0b87942f519f2c67a17107ee\"}, {\"url\": \"https://git.kernel.org/stable/c/10569b682ebe9c75ef06ddd322ae844e9be6374b\"}, {\"url\": \"https://git.kernel.org/stable/c/d6f08c88047accc6127dddb6798a3ff11321539d\"}, {\"url\": \"https://git.kernel.org/stable/c/bfe5c02654261bfb8bd9cb174a67f3279ea99e58\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to check atomic_file in f2fs ioctl interfaces\\n\\nSome f2fs ioctl interfaces like f2fs_ioc_set_pin_file(),\\nf2fs_move_file_range(), and f2fs_defragment_range() missed to\\ncheck atomic_write status, which may cause potential race issue,\\nfix it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:40:07.797Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49859\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:40:07.797Z\", \"dateReserved\": \"2024-10-21T12:17:06.017Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:27:17.968Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.