CVE-2024-38636

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: multidev: fix to recognize valid zero block address

As reported by Yi Zhang in mailing list [1], kernel warning was catched

during zbd/010 test as below:

./check zbd/010

zbd/010 (test gap zone support with F2FS) [failed]

runtime ... 3.752s

something found in dmesg:

[ 4378.146781] run blktests zbd/010 at 2024-02-18 11:31:13

[ 4378.192349] null_blk: module loaded

[ 4378.209860] null_blk: disk nullb0 created

[ 4378.413285] scsi_debug:sdebug_driver_probe: scsi_debug: trim

poll_queues to 0. poll_q/nr_hw = (0/1)

[ 4378.422334] scsi host15: scsi_debug: version 0191 [20210520]

dev_size_mb=1024, opts=0x0, submit_queues=1, statistics=0

[ 4378.434922] scsi 15:0:0:0: Direct-Access-ZBC Linux

scsi_debug 0191 PQ: 0 ANSI: 7

[ 4378.443343] scsi 15:0:0:0: Power-on or device reset occurred

[ 4378.449371] sd 15:0:0:0: Attached scsi generic s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References