CVE-2024-47740 (GCVE-0-2024-47740)
Vulnerability from cvelistv5
Published
2024-10-21 12:14
Modified
2026-08-05 11:39
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
References
Impacted products
Vendor Product Version
Linux Linux Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
Version: 88b88a66797159949cec32eaab12b4968f6fae2d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:19.414286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:14.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:36.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "000bab8753ae29a259feb339b99ee759795a48ac",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "88ff021e1fea2d9b40b2d5efd9013c89f7be04ac",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "5e0de753bfe87768ebe6744d869caa92f35e5731",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "f3bfac2cabf5333506b263bc0c8497c95302f32d",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4583290898c13c2c2e5eb8773886d153c2c5121d",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            },
            {
              "lessThan": "4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
              "status": "affected",
              "version": "88b88a66797159949cec32eaab12b4968f6fae2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: Require FMODE_WRITE for atomic write ioctls\n\nThe F2FS ioctls for starting and committing atomic writes check for\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\n\nThere are scenarios where LSMs want to deny a process the ability to write\nparticular files, even files that the FSUID of the process owns; but this\ncan currently partially be bypassed using atomic write ioctls in two ways:\n\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\n   truncate an inode to size 0\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\n   changes another process concurrently made to a file\n\nFix it by requiring FMODE_WRITE for these operations, just like for\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\nioctls when intending to write into the file, that seems unlikely to break\nanything."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing F2FS_IOC_START_ATOMIC_REPLACE/COMMIT/ABORT ioctls on a local file descriptor for a regular file on a locally-mounted f2fs filesystem. There is no network-reachable path to fs/f2fs/file.c ioctl handlers.\nAC:L - The destructive primitive is two deterministic ioctl calls on an fd the attacker already holds \u2014 no race, no memory-layout dependency, no timing sensitivity. Even the rollback variant is attacker-timed: it chooses when to START and when to ABORT, and any concurrent writes landing in that window are discarded, so a wider window simply catches more.\nPR:L - Only local unprivileged code execution plus an O_RDONLY fd on a file whose UID matches the attacker\u0027s FSUID is needed; inode_owner_or_capable() short-circuits on the UID match, so no capability, user namespace, or root is required. mnt_want_write_file() checks only that the mount is writable, not the fd.\nUI:N - START_ATOMIC_REPLACE + COMMIT_ATOMIC_WRITE truncates the file to zero entirely under attacker control, with no victim action required. The attacker opens the file itself and needs nothing from any other process.\nS:U - The vulnerable f2fs ioctl handler and the impacted files are both governed by the kernel\u0027s security authority; bypassing an in-kernel LSM check is not a crossing into a different authority. No hypervisor, IOMMU, or VM boundary is traversed.\nC:N - The bug is purely a missing write-side access-control check \u2014 the attacker already holds read access to the target file, so nothing new is disclosed. No kernel memory is leaked and no read primitive is created.\nI:H - The attacker gains write-equivalent power over files the security policy explicitly protected from modification: complete irreversible truncation to size 0, and silent rollback of another process\u0027s already-acknowledged writes. For a Landlock- or SELinux-confined process the protected file set is exactly what falls, and every byte of it can be destroyed \u2014 a total loss of integrity for the affected resources.\nA:H - Truncating a target such as a system database, keystore, or configuration file to zero permanently destroys the resource and renders the depending service unavailable. Independently, the attacker can pin the inode in atomic-write state for as long as it chooses, causing all O_DIRECT reads/writes from legitimate processes to fail -EOPNOTSUPP and fallocate/MOVE_RANGE/SET_PIN_FILE/defrag to fail -EINVAL \u2014 a sustained, attacker-controlled denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:50.713Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece"
        },
        {
          "url": "https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e"
        }
      ],
      "title": "f2fs: Require FMODE_WRITE for atomic write ioctls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47740",
    "datePublished": "2024-10-21T12:14:09.171Z",
    "dateReserved": "2024-09-30T16:00:12.959Z",
    "dateUpdated": "2026-08-05T11:39:50.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:36.961Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:19.414286Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:22.941Z\"}}], \"cna\": {\"title\": \"f2fs: Require FMODE_WRITE for atomic write ioctls\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires issuing F2FS_IOC_START_ATOMIC_REPLACE/COMMIT/ABORT ioctls on a local file descriptor for a regular file on a locally-mounted f2fs filesystem. There is no network-reachable path to fs/f2fs/file.c ioctl handlers.\\nAC:L - The destructive primitive is two deterministic ioctl calls on an fd the attacker already holds \\u2014 no race, no memory-layout dependency, no timing sensitivity. Even the rollback variant is attacker-timed: it chooses when to START and when to ABORT, and any concurrent writes landing in that window are discarded, so a wider window simply catches more.\\nPR:L - Only local unprivileged code execution plus an O_RDONLY fd on a file whose UID matches the attacker\u0027s FSUID is needed; inode_owner_or_capable() short-circuits on the UID match, so no capability, user namespace, or root is required. mnt_want_write_file() checks only that the mount is writable, not the fd.\\nUI:N - START_ATOMIC_REPLACE + COMMIT_ATOMIC_WRITE truncates the file to zero entirely under attacker control, with no victim action required. The attacker opens the file itself and needs nothing from any other process.\\nS:U - The vulnerable f2fs ioctl handler and the impacted files are both governed by the kernel\u0027s security authority; bypassing an in-kernel LSM check is not a crossing into a different authority. No hypervisor, IOMMU, or VM boundary is traversed.\\nC:N - The bug is purely a missing write-side access-control check \\u2014 the attacker already holds read access to the target file, so nothing new is disclosed. No kernel memory is leaked and no read primitive is created.\\nI:H - The attacker gains write-equivalent power over files the security policy explicitly protected from modification: complete irreversible truncation to size 0, and silent rollback of another process\u0027s already-acknowledged writes. For a Landlock- or SELinux-confined process the protected file set is exactly what falls, and every byte of it can be destroyed \\u2014 a total loss of integrity for the affected resources.\\nA:H - Truncating a target such as a system database, keystore, or configuration file to zero permanently destroys the resource and renders the depending service unavailable. Independently, the attacker can pin the inode in atomic-write state for as long as it chooses, causing all O_DIRECT reads/writes from legitimate processes to fail -EOPNOTSUPP and fallocate/MOVE_RANGE/SET_PIN_FILE/defrag to fail -EINVAL \\u2014 a sustained, attacker-controlled denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"000bab8753ae29a259feb339b99ee759795a48ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"32f348ecc149e9ca70a1c424ae8fa9b6919d2713\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"5e0de753bfe87768ebe6744d869caa92f35e5731\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"f3bfac2cabf5333506b263bc0c8497c95302f32d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4583290898c13c2c2e5eb8773886d153c2c5121d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"88b88a66797159949cec32eaab12b4968f6fae2d\", \"lessThan\": \"4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/f2fs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653\"}, {\"url\": \"https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece\"}, {\"url\": \"https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac\"}, {\"url\": \"https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac\"}, {\"url\": \"https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713\"}, {\"url\": \"https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731\"}, {\"url\": \"https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d\"}, {\"url\": \"https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d\"}, {\"url\": \"https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: Require FMODE_WRITE for atomic write ioctls\\n\\nThe F2FS ioctls for starting and committing atomic writes check for\\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\\nLandlock an opportunity to deny the write access - if the caller\u0027s FSUID\\nmatches the inode\u0027s UID, inode_owner_or_capable() immediately returns true.\\n\\nThere are scenarios where LSMs want to deny a process the ability to write\\nparticular files, even files that the FSUID of the process owns; but this\\ncan currently partially be bypassed using atomic write ioctls in two ways:\\n\\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\\n   truncate an inode to size 0\\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\\n   changes another process concurrently made to a file\\n\\nFix it by requiring FMODE_WRITE for these operations, just like for\\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\\nioctls when intending to write into the file, that seems unlikely to break\\nanything.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:39:50.713Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:39:50.713Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:09.171Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.