CVE-2024-27070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault

syzbot reports a f2fs bug as below:

BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49

Read of size 8 at addr ffff88807bb22680 by task syz-executor184/5058

CPU: 0 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106

print_address_description mm/kasan/report.c:377 [inline]

print_report+0x163/0x540 mm/kasan/report.c:488

kasan_report+0x142/0x170 mm/kasan/report.c:601

f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49

__do_fault+0x131/0x450 mm/memory.c:4376

do_shared_fault mm/memory.c:4798 [inline]

do_fault mm/memory.c:4872 [inline]

do_pte_missing mm/memory.c:3745 [inline]

handle_pte_fault mm/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References