In the Linux kernel, the following vulnerability has been resolved:
f2fs: Require FMODE_WRITE for atomic write ioctls
The F2FS ioctls for starting and committing atomic writes check for inodeownerorcapable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inodeownerorcapable() immediately returns true.
There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways:
Fix it by requiring FMODEWRITE for these operations, just like for F2FSIOCMOVERANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
[
{
"id": "CVE-2024-47740-00555319",
"signature_version": "v1",
"digest": {
"function_hash": "233065000113558429035433433051991401885",
"length": 2054.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-00e95ce1",
"signature_version": "v1",
"digest": {
"function_hash": "315113436172833414753162085136398533169",
"length": 546.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-03e0b460",
"signature_version": "v1",
"digest": {
"function_hash": "183371205831718757304510572993599451303",
"length": 713.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-08eef9cd",
"signature_version": "v1",
"digest": {
"function_hash": "187914587706851026825294393252124775608",
"length": 421.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_release_volatile_write"
}
},
{
"id": "CVE-2024-47740-0b49e66c",
"signature_version": "v1",
"digest": {
"function_hash": "338743154665238342041781772599156113027",
"length": 528.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_volatile_write"
}
},
{
"id": "CVE-2024-47740-0e87f34a",
"signature_version": "v1",
"digest": {
"function_hash": "11279099697803977544930051338470298761",
"length": 1476.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-0f76042e",
"signature_version": "v1",
"digest": {
"function_hash": "45237682839206003651446579174931072267",
"length": 1101.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-1ad3706c",
"signature_version": "v1",
"digest": {
"function_hash": "187914587706851026825294393252124775608",
"length": 421.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_release_volatile_write"
}
},
{
"id": "CVE-2024-47740-2a5a0784",
"signature_version": "v1",
"digest": {
"function_hash": "109114040471194184190323068695214827078",
"length": 2029.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0de753bfe87768ebe6744d869caa92f35e5731",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-2f48cb00",
"signature_version": "v1",
"digest": {
"function_hash": "183371205831718757304510572993599451303",
"length": 713.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-3bb59361",
"signature_version": "v1",
"digest": {
"function_hash": "237951132782293351827945922934783889268",
"length": 367.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3bfac2cabf5333506b263bc0c8497c95302f32d",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_atomic_write"
}
},
{
"id": "CVE-2024-47740-3f7acfe6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-481b7fff",
"signature_version": "v1",
"digest": {
"function_hash": "250184315429716507795091580245107487472",
"length": 815.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-6b5de520",
"signature_version": "v1",
"digest": {
"function_hash": "338743154665238342041781772599156113027",
"length": 528.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_volatile_write"
}
},
{
"id": "CVE-2024-47740-73548722",
"signature_version": "v1",
"digest": {
"function_hash": "222971754529940791727698060618530125061",
"length": 518.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_volatile_write"
}
},
{
"id": "CVE-2024-47740-7957adb2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"14616420784639665302452224708190910745",
"66744580827278873191953841583991136550",
"18806641281770422502069563142464810381",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3bfac2cabf5333506b263bc0c8497c95302f32d",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-7b932705",
"signature_version": "v1",
"digest": {
"function_hash": "222971754529940791727698060618530125061",
"length": 518.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_volatile_write"
}
},
{
"id": "CVE-2024-47740-7cb61f65",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127057860591702791523546801585052203602",
"85105464696432421396649499842556019798",
"219292821576279191089691615696400095289",
"175116684513916090014086507420996571909",
"322721262200086535669695512832829281289",
"151641263779990484213997410365935214863",
"175116684513916090014086507420996571909",
"322721262200086535669695512832829281289",
"151641263779990484213997410365935214863"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-84940afc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"14616420784639665302452224708190910745",
"66744580827278873191953841583991136550",
"18806641281770422502069563142464810381",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0de753bfe87768ebe6744d869caa92f35e5731",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-865587df",
"signature_version": "v1",
"digest": {
"function_hash": "315113436172833414753162085136398533169",
"length": 546.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3bfac2cabf5333506b263bc0c8497c95302f32d",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-8ee709cd",
"signature_version": "v1",
"digest": {
"function_hash": "222971754529940791727698060618530125061",
"length": 518.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_volatile_write"
}
},
{
"id": "CVE-2024-47740-988337ec",
"signature_version": "v1",
"digest": {
"function_hash": "79936071325843421220908008066007091105",
"length": 1437.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-9fd2b539",
"signature_version": "v1",
"digest": {
"function_hash": "237951132782293351827945922934783889268",
"length": 367.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_atomic_write"
}
},
{
"id": "CVE-2024-47740-a49af912",
"signature_version": "v1",
"digest": {
"function_hash": "315113436172833414753162085136398533169",
"length": 546.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0de753bfe87768ebe6744d869caa92f35e5731",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-ad539119",
"signature_version": "v1",
"digest": {
"function_hash": "257021660082582294849412303637366527664",
"length": 2049.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3bfac2cabf5333506b263bc0c8497c95302f32d",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-af2d8c0e",
"signature_version": "v1",
"digest": {
"function_hash": "338743154665238342041781772599156113027",
"length": 528.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_volatile_write"
}
},
{
"id": "CVE-2024-47740-b10dc325",
"signature_version": "v1",
"digest": {
"function_hash": "237951132782293351827945922934783889268",
"length": 367.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_atomic_write"
}
},
{
"id": "CVE-2024-47740-b520beed",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218846528383306109010588621419356620640",
"96565435371736415648603837170176827202",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-c9ca0d36",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147044426098680388298235841448965295975",
"66744580827278873191953841583991136550",
"18806641281770422502069563142464810381",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826",
"24033549889137043692291897692394881738",
"240701581931773461343966635934808402484",
"285572517397644075404449052223189880826"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-cb8eb88d",
"signature_version": "v1",
"digest": {
"function_hash": "315113436172833414753162085136398533169",
"length": 546.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5a100f87f32cb65d4bb1ad282a08c92f6f591e",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_commit_atomic_write"
}
},
{
"id": "CVE-2024-47740-d16896ba",
"signature_version": "v1",
"digest": {
"function_hash": "237951132782293351827945922934783889268",
"length": 367.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0de753bfe87768ebe6744d869caa92f35e5731",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_abort_atomic_write"
}
},
{
"id": "CVE-2024-47740-f0101fc4",
"signature_version": "v1",
"digest": {
"function_hash": "326057535603923273355975269263697246840",
"length": 1951.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32f348ecc149e9ca70a1c424ae8fa9b6919d2713",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_start_atomic_write"
}
},
{
"id": "CVE-2024-47740-f38fd9d7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218846528383306109010588621419356620640",
"96565435371736415648603837170176827202",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"324686823172286963399506580591767954351",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992",
"304494275283337346911373108936285719100",
"162238993164270826858444288960835082044",
"159359690197594706400785152358530135992"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@000bab8753ae29a259feb339b99ee759795a48ac",
"target": {
"file": "fs/f2fs/file.c"
}
},
{
"id": "CVE-2024-47740-f8d18b76",
"signature_version": "v1",
"digest": {
"function_hash": "187914587706851026825294393252124775608",
"length": 421.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ce87674c3a6b4d3b3d45f85b584ab8618a3cece",
"target": {
"file": "fs/f2fs/file.c",
"function": "f2fs_ioc_release_volatile_write"
}
}
]