CVE-2024-36001: netfs: Fix the pre-flush when appending to a file in writethrough mode
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix the pre-flush when appending to a file in writethrough mode
In netfs_perform_write(), when the file is marked NETFS_ICTX_WRITETHROUGH
or O_*SYNC or RWF_*SYNC was specified, write-through caching is performed
on a buffered file. When setting up for write-through, we flush any
conflicting writes in the region and wait for the write to complete,
failing if there's a write error to return.
The issue arises if we're writing at or above the EOF position because we
skip the flush and - more importantly - the wait. This becomes a problem
if there's a partial folio at the end of the file that is being written out
and we want to make a write to it too. Both the already-running write and
the write we start both want to clear the writeback mark, but whoever is
second causes a warning looking something like:
------------[ cut here ]------------
R=00000012: folio 11 is not under writeback
WARNING: CPU: 34 PID: 654 at fs/netfs/write_collect.c:105
...
CPU: 34 PID: 654 Comm: kworker/u386:27 Tainted: G S ...
...
Workqueue: events_unbound netfs_write_collection_worker
...
RIP: 0010:netfs_writeback_lookup_folio
Fix this by making the flush-and-wait unconditional. It will do nothing if
there are no folios in the pagecache and will return quickly if there are
no folios in the region specified.
Further, move the WBC attachment above the flush call as the flush is going
to attach a WBC and detach it again if it is not present - and since we
need one anyway we might as well share it.
Security readout for executives and security teams
Plain-English summary
A Linux netfs write-ordering flaw can mishandle overlapping writeback when data is appended in write-through or synchronous mode. The supplied description documents a kernel warning caused by competing writes. Although scored 7.8, the sources do not demonstrate practical confidentiality, integrity, or availability impact.
Executive priority
Treat as a high-priority kernel maintenance issue on systems matching the affected versions and workload. Accelerate remediation for netfs-heavy or multi-user hosts, but avoid claiming compromise: the supplied evidence establishes faulty writeback coordination and a warning, not observed exploitation or demonstrated data loss.
Technical view
netfs_perform_write() skipped its pre-flush and wait at or beyond EOF. A concurrent writeback of the final partial folio could then overlap a new append, causing both operations to clear the same writeback marker. The fix makes flush-and-wait unconditional and attaches the writeback-control structure earlier.
Likely exposure
The bundle identifies Linux kernel 6.8 through 6.8.9 and 6.9 as affected. Exposure is most plausible where netfs-backed files receive append or at-EOF writes using write-through, O_*SYNC, or RWF_*SYNC behavior. Distribution backports may change actual status.
Exploitation context
The supplied CVSS vector describes local access, low complexity, low privileges, and no user interaction. CVE-2024-36001 is not listed as KEV in the bundle, and no supplied source reports active exploitation or a public exploit. Practical security consequences remain insufficiently evidenced here.
Researcher notes
The central condition is an at-or-beyond-EOF write overlapping writeback of a partial final folio. Assess reachability through the deployed netfs consumer and sync flags. The two stable commits are the authoritative supplied fix references. No CWE is provided, and the bundle does not reconcile the CVSS impact claims with demonstrated outcomes.
Mitigation direction
Install a vendor-supported kernel containing the applicable stable fix or backport.
Check distribution advisories for package-specific affected and fixed versions.
Prioritize systems using netfs-backed storage with synchronous or write-through append workloads.
Follow current Linux or distribution vendor guidance if immediate updating is unavailable.
Validation and detection
Inventory running kernel versions and distribution package revisions.
Confirm the vendor marks each deployed kernel build fixed or unaffected.
Verify the applicable stable fix is present in custom kernel source trees.
Review kernel logs for the documented netfs writeback warning signature.
Safely regression-test synchronous append workloads after updating.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-36001 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.