Executive brief
A vulnerability in the Linux kernel's F2FS file system could lead to data corruption. When the file system is reconfigured (remounted), there is a brief moment where encryption settings are accidentally disabled. If a file is opened or created during this specific window, it may not be properly encrypted, potentially leading to permanent data loss or corruption.
Technical details
A race condition exists in the F2FS file system implementation within the Linux kernel during the remount process. In the `f2fs_remount` function, the `SB_INLINECRYPT` flag is cleared in `default_options` and subsequently re-set in `parse_options`. If a concurrent thread executes `f2fs_file_open` or `f2fs_new_inode` during this window, the `fscrypt_select_encryption_impl` function may fail to utilize inline encryption. This is particularly critical when `wrappedkey_v0` is enabled, as it can result in data corruption. The fix involves removing the code that clears the `SB_INLINECRYPT` flag during the default options initialization.
Affected products
- Linux Linux Kernel 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7, 3.8 to 5.10.221
Timeline
- 2024-03-29: patched: Initial patch in mainline kernel
- 2024-07-12: disclosed: CVE-2024-40971 published
References
- https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71
- https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae
- https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4
- https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33
- https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66
- https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html