Security readout for executives and security teams
Plain-English summary
A flaw in Linux F2FS handling can crash the operating system when a read-only F2FS filesystem is accessed and later unmounted. Exploitation requires local, low-privileged access and no user interaction. A successful trigger could interrupt services and require recovery or restart; the supplied CVSS assessment also rates confidentiality and integrity impact as high.
Executive priority
Prioritize remediation on multi-user systems, shared hosts, and devices using F2FS because a low-privileged local actor may cause a full system crash. Treat internet-only exposure as lower unless another path provides local execution. Use normal emergency kernel-maintenance processes where availability is critical.
Technical view
F2FS may mark an inode dirty while repairing directory depth on a read-only filesystem. Read-only shutdown skips filesystem synchronization, leaving the dirty flag set. During inode eviction at unmount, an internal consistency check detects that flag and triggers a kernel panic. The stable-kernel commits prevent the inode from being dirtied in this path.
Likely exposure
Exposure is limited to Linux systems using F2FS and a vulnerable kernel revision. Systems that never mount F2FS have substantially lower practical exposure. The supplied version data identifies multiple affected kernel lines but is not sufficiently structured to determine every distribution package; confirm status with the kernel or distribution vendor.
Exploitation context
The CVSS vector indicates a local attacker with low privileges, low complexity, and no user interaction. The source describes a syzbot-discovered kernel panic. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The relevant path is directory-depth repair during F2FS lookup on a read-only superblock, followed by unmount and inode eviction. The correction skips dirty-inode handling for that repair. The bundle lists several stable backports, so commit applicability must be matched to the deployed kernel branch rather than inferred from one hash.
Mitigation direction
- Install the vendor-supported kernel update containing the applicable stable F2FS fix.
- Consult the Linux distribution advisory to map fixed upstream commits to package versions.
- Until updated, limit untrusted users' ability to mount or interact with F2FS filesystems.
- Prioritize systems where local users, containers, or services can reach F2FS-backed storage.
Validation and detection
- Inventory kernel versions and identify systems with F2FS enabled, mounted, or available for mounting.
- Compare installed distribution packages with vendor advisories and applicable stable-kernel commits.
- Check system logs for F2FS eviction assertions, kernel BUG messages, panics, or unexpected restarts.
- After updating, verify the running kernel matches the installed fixed package following reboot.
Public sources used
- CVE Program record
- CVE List V5 record
- Linux stable fix 2d291651
- Linux stable fix 54162974
- Linux stable fix 54bc4e88
- Linux stable fix ec56571b
- Linux stable fix 9ce8135a
- Linux stable fix e62ff092
- Linux stable fix 24343445
- Linux stable fix 192b8fb8
- Debian LTS advisory, January 2025
- Debian LTS advisory, October 2024
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42297 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2d2916516577f2239b3377d9e8d12da5e6ccdfcfCVE reference, Linux
- https://git.kernel.org/stable/c/54162974aea37a8cae00742470a78c7f6bd6f915CVE reference, Linux
- https://git.kernel.org/stable/c/54bc4e88447e385c4d4ffa85d93e0dce628fcfa6CVE reference, Linux
- https://git.kernel.org/stable/c/ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1CVE reference, Linux
- https://git.kernel.org/stable/c/9ce8135accf103f7333af472709125878704fdd4CVE reference, Linux
- https://git.kernel.org/stable/c/e62ff092a42f4a1bae3b310cf46673b4f3aac3b5CVE reference, Linux
- https://git.kernel.org/stable/c/2434344559f6743efb3ac15d11af9a0db9543bd3CVE reference, Linux
- https://git.kernel.org/stable/c/192b8fb8d1c8ca3c87366ebbef599fa80bb626b8CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.