CVE-2024-40971

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40971

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: f2fs: remove clear SB_INLINECRYPT flag in default_options In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again

References
Link Resource
https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 Patch
https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae Patch
https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 Patch
https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 Patch
https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 Patch
https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 Patch
https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 Patch
https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae Patch
https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 Patch
https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 Patch
https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 Patch
https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 22:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

06 Oct 2025, 20:44

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 - () https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 - Patch
References () https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae - () https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae - Patch
References () https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 - () https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 - Patch
References () https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 - () https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 - Patch
References () https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 - () https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 - Patch
References () https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 - () https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 - Patch
CWE NVD-CWE-noinfo

21 Nov 2024, 09:31

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 - () https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 -
References () https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae - () https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae -
References () https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 - () https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 -
References () https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 - () https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 -
References () https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 - () https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 -
References () https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 - () https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: eliminar el indicador SB_INLINECRYPT en default_options En f2fs_remount, el indicador SB_INLINECRYPT se borrará y se restablecerá. Si crea un archivo nuevo o abre un archivo durante este intervalo, estos archivos no utilizarán inlinecrypt. En el peor de los casos, puede provocar daños en los datos si Wrappedkey_v0 está habilitado. Hilo A: Hilo B: -f2fs_remount -f2fs_file_open o f2fs_new_inode -default_options &lt;- borrar el indicador SB_INLINECRYPT -fscrypt_select_encryption_impl -parse_options &lt;- configurar SB_INLINECRYPT nuevamente

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2025-11-03 22:17

NVD link : CVE-2024-40971

Mitre link : CVE-2024-40971

CVE.ORG link : CVE-2024-40971

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo