Linux Kernel
CVE-2024-34027
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the compound requirement of a race window plus SPO event; C:L because metadata corruption does not directly disclose confidential data.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode, inode fields and .total_valid_block_count may be corrupted after SPO case.
AnalysisAI
Filesystem metadata corruption in the Linux kernel's f2fs compress subsystem stems from a missing cp_rwsem lock around the reserve_compress_blocks() and release_compress_blocks() functions, creating a race condition with checkpoint operations. Systems using f2fs with compression enabled are at risk of corrupted block addresses in dnode structures, inode fields, and the global total_valid_block_count counter if a Sudden Power Off (SPO) occurs during the race window. No public exploit exists and EPSS is 0.02% (6th percentile), marking this as a data integrity and reliability concern rather than an active attack target.
Technical ContextAI
f2fs (Flash-Friendly File System) is a Linux kernel filesystem optimized for NAND flash and SSD storage, widely used in Android devices and embedded Linux systems. The cp_rwsem is a critical read-write semaphore that serializes checkpoint operations - periodic metadata consistency snapshots - against concurrent filesystem modifications. The compress subsystem's block reservation and release paths (reserve_compress_blocks and release_compress_blocks) were not acquiring cp_rwsem, meaning they could execute concurrently with an active checkpoint. This time-of-check-to-time-of-use race, when interrupted by an SPO, leaves dnode block addresses, inode metadata fields, and the global total_valid_block_count in an inconsistent state. The assigned CWE-770 (Allocation of Resources Without Limits) imprecisely describes the root cause - CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) is a better fit, as this is fundamentally a missing lock protecting shared metadata. Affected products per CPE: cpe:2.3:o:linux:linux_kernel across multiple stable branches.
RemediationAI
Apply the upstream kernel patches: six stable-branch commits are available at git.kernel.org - 0a4ed2d9, 329edb7c, 5d47d638, 69136304, a6e1f774, and b5bac438 - all adding cp_rwsem locking around the compress block reservation and release paths. Distributions should be patched via their respective stable kernel updates. Siemens customers should follow SSA-265688 for product-specific patch guidance. As a compensating control for systems where immediate kernel upgrade is not feasible, disabling f2fs compression (remounting without compress mount options or reformatting without compression) removes the vulnerable code path entirely; the trade-off is loss of storage space savings on flash media. Systems not using f2fs as their filesystem are unaffected and require no action.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today