CVE-2024-56692

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The attack requires a crafted f2fs image to be mounted on the local system and is then triggered through ordinary local filesystem syscalls (`openat`, `unlink`, `truncate`) reaching `truncate_node()`; no network protocol is involved.

AC:LAttack complexity, low

The corrupted `block_addr` is a static, fully attacker-chosen field in the on-disk NAT journal that `remove_nats_in_journal()` copies into the NAT cache verbatim, so `truncate_node()` picks it up deterministically on every node truncation — no race, no timing window, and no dependence on memory layout the attacker cannot influence.

PR:LPrivileges required, low

Once the malicious volume is mounted — automatically by udisks2 on desktops/kiosks or by vold for Android SD-card/adoptable storage, since f2fs is Android's primary filesystem — any unprivileged user with access to the mount triggers the path with a plain file create, unlink, or truncate; no capability check stands between that user and `truncate_node()`.

UI:NUser interaction, none

The attacker performs both halves of the attack: the volume is mounted automatically on media insertion by the automounter, and the trigger is the attacker's own ordinary file operation, requiring no action by any victim.

S:UScope, unchanged

The out-of-bounds accesses and the resulting corruption are confined to kernel memory of the same machine; no VM, IOMMU, or other security-authority boundary is crossed.

C:HConfidentiality impact, high

`get_seg_entry()` indexes `sit_i->sentries[]` with an unbounded `segno` derived from the attacker's 32-bit blkaddr and performs no bounds check, so `update_segment_mtime()`/`update_sit_entry()` read `struct seg_entry` fields — including the `cur_valid_map`/`ckpt_valid_map`/`discard_map` pointers — from arbitrary kernel memory far outside the array.

I:HIntegrity impact, high

The same unbounded index produces out-of-bounds writes to `se->mtime`, `se->valid_blocks`, the `dirty_sentries_bitmap` bit set by `__mark_sit_entry_dirty()`, and `get_sec_entry()->valid_blocks`, plus a bit-clear performed through `se->cur_valid_map` — a pointer that was itself read out of bounds — giving a wild-pointer write primitive suitable for control-flow hijacking.

A:HAvailability impact, high

The reported symptom is an outright kernel panic at `f2fs_bug_on(sbi, addr == NULL_ADDR)` in `f2fs_invalidate_blocks()` (`BUG_ON` under `CONFIG_F2FS_CHECK_FS`, `WARN_ON` elsewhere, fatal with `panic_on_warn`), and the out-of-bounds pointer dereferences oops the kernel independently.