LiveActive security incident?Get immediate response
CVE Record

CVE-2024-47736: erofs: handle overlapped pclusters out of crafted images properly

In the Linux kernel, the following vulnerability has been resolved: erofs: handle overlapped pclusters out of crafted images properly syzbot reported a task hang issue due to a deadlock case where it is waiting for the folio lock of a cached folio that will be used for cache I/Os. After looking into the crafted fuzzed image, I found it's formed with several overlapped big pclusters as below: Ext: logical offset | length : physical offset | length 0: 0.. 16384 | 16384 : 151552.. 167936 | 16384 1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384 2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384 ... Here, extent 0/1 are physically overlapped although it's entirely _impossible_ for normal filesystem images generated by mkfs. First, managed folios containing compressed data will be marked as up-to-date and then unlocked immediately (unlike in-place folios) when compressed I/Os are complete. If physical blocks are not submitted in the incremental order, there should be separate BIOs to avoid dependency issues. However, the current code mis-arranges z_erofs_fill_bio_vec() and BIO submission which causes unexpected BIO waits. Second, managed folios will be connected to their own pclusters for efficient inter-queries. However, this is somewhat hard to implement easily if overlapped big pclusters exist. Again, these only appear in fuzzed images so let's simply fall back to temporary short-lived pages for correctness. Additionally, it justifies that referenced managed folios cannot be truncated for now and reverts part of commit 2080ca1ed3e4 ("erofs: tidy up `struct z_erofs_bvec`") for simplicity although it shouldn't be any difference.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-47736 is a Linux kernel EROFS filesystem bug where a specially crafted image can trigger a deadlock and hang a task. The source says normal images made by mkfs should not create the problematic overlapping compressed clusters.

Executive priority

Prioritize based on exposure to untrusted filesystem images. This is not evidenced as internet-exploited, but it can affect availability where Linux systems process crafted EROFS images.

Technical view

The EROFS compressed data path mishandled overlapping big pclusters in crafted images. Incorrect BIO arrangement and managed folio handling could cause unexpected waits on cached folio locks. The kernel fix changes handling for overlapping pclusters and falls back to temporary pages for correctness.

Likely exposure

Exposure is most relevant where Linux systems mount or inspect untrusted EROFS images, such as removable media, firmware images, appliance workflows, or image-processing services. Systems that never process EROFS images have lower practical exposure.

Exploitation context

The bundle lists KEV as false and provides no evidence of active exploitation. The triggering image shape came from fuzzing and is described as impossible for normal mkfs-generated filesystem images.

Researcher notes

Key constraints are incomplete severity data and no CVSS in the supplied bundle. The vulnerability appears availability-focused from a crafted filesystem image, with fixes in Linux stable commits and downstream vendor advisories.

Mitigation direction

  • Apply vendor kernel updates that include the referenced Linux stable EROFS fixes.
  • Avoid mounting untrusted EROFS images until patched.
  • Restrict who can mount filesystem images on shared systems.
  • Check Siemens advisories for affected Siemens products and product-specific remediation.
  • Follow distribution vendor guidance for backported kernel fixes.

Validation and detection

  • Inventory Linux kernel versions across systems and appliances.
  • Identify systems that mount or scan EROFS images.
  • Compare running kernels against vendor advisories for CVE-2024-47736.
  • Review EROFS-related workflows involving removable media or firmware images.
  • Confirm patched kernels include the referenced stable commits or vendor backports.
Prepared
Confidence
medium
Sources
9

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-47736 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8e6c8fa9f2e95c88a642521a5da19a8e31748846, 8e6c8fa9f2e95c88a642521a5da19a8e31748846, 8e6c8fa9f2e95c88a642521a5da19a8e31748846, 8e6c8fa9f2e95c88a642521a5da19a8e31748846, 8e6c8fa9f2e95c88a642521a5da19a8e31748846unaffected
LinuxLinux5.13, 0, 6.1.168, 6.6.72, 6.10.13, 6.11.2, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.