CVE-2024-47740
f2fs: Require FMODE_WRITE for atomic write ioctls
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
INFO
Published Date :
Oct. 21, 2024, 1:15 p.m.
Last Modified :
Nov. 3, 2025, 11:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the affected kernel packages.
- Reboot the system to apply the changes.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-47740.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-47740 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-47740
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-47740 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-47740 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html -
Initial Analysis by [email protected]
Oct. 08, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11 up to (excluding) 6.11.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.13 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.54 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.113 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.227 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.18 up to (excluding) 4.19.323 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.285 Added Reference Type kernel.org: https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 08, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4ce87674c3a6b4d3b3d45f85b584ab8618a3cece [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways: - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0 - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything. Added Reference kernel.org https://git.kernel.org/stable/c/000bab8753ae29a259feb339b99ee759795a48ac [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/88ff021e1fea2d9b40b2d5efd9013c89f7be04ac [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/32f348ecc149e9ca70a1c424ae8fa9b6919d2713 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5e0de753bfe87768ebe6744d869caa92f35e5731 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f3bfac2cabf5333506b263bc0c8497c95302f32d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4583290898c13c2c2e5eb8773886d153c2c5121d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4f5a100f87f32cb65d4bb1ad282a08c92f6f591e [No types assigned]