CVE-2024-47740

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: Require FMODE_WRITE for atomic write ioctls

The F2FS ioctls for starting and committing atomic writes check for

inode_owner_or_capable(), but this does not give LSMs like SELinux or

Landlock an opportunity to deny the write access - if the caller's FSUID

matches the inode's UID, inode_owner_or_capable() immediately returns true.

There are scenarios where LSMs want to deny a process the ability to write

particular files, even files that the FSUID of the process owns; but this

can currently partially be bypassed using atomic write ioctls in two ways:

- F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can

truncate an inode to size 0

- F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert

changes another process concurrently made to a file

Fix it by requiring FMODE_WRITE for these operations, just like for

F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References