CVE-2024-47736: erofs: handle overlapped pclusters out of crafted images properly
In the Linux kernel, the following vulnerability has been resolved:
erofs: handle overlapped pclusters out of crafted images properly
syzbot reported a task hang issue due to a deadlock case where it is
waiting for the folio lock of a cached folio that will be used for
cache I/Os.
After looking into the crafted fuzzed image, I found it's formed with
several overlapped big pclusters as below:
Ext: logical offset | length : physical offset | length
0: 0.. 16384 | 16384 : 151552.. 167936 | 16384
1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384
2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384
...
Here, extent 0/1 are physically overlapped although it's entirely
_impossible_ for normal filesystem images generated by mkfs.
First, managed folios containing compressed data will be marked as
up-to-date and then unlocked immediately (unlike in-place folios) when
compressed I/Os are complete. If physical blocks are not submitted in
the incremental order, there should be separate BIOs to avoid dependency
issues. However, the current code mis-arranges z_erofs_fill_bio_vec()
and BIO submission which causes unexpected BIO waits.
Second, managed folios will be connected to their own pclusters for
efficient inter-queries. However, this is somewhat hard to implement
easily if overlapped big pclusters exist. Again, these only appear in
fuzzed images so let's simply fall back to temporary short-lived pages
for correctness.
Additionally, it justifies that referenced managed folios cannot be
truncated for now and reverts part of commit 2080ca1ed3e4 ("erofs: tidy
up `struct z_erofs_bvec`") for simplicity although it shouldn't be any
difference.
Security readout for executives and security teams
Plain-English summary
CVE-2024-47736 is a Linux kernel EROFS filesystem bug where a specially crafted image can trigger a deadlock and hang a task. The source says normal images made by mkfs should not create the problematic overlapping compressed clusters.
Executive priority
Prioritize based on exposure to untrusted filesystem images. This is not evidenced as internet-exploited, but it can affect availability where Linux systems process crafted EROFS images.
Technical view
The EROFS compressed data path mishandled overlapping big pclusters in crafted images. Incorrect BIO arrangement and managed folio handling could cause unexpected waits on cached folio locks. The kernel fix changes handling for overlapping pclusters and falls back to temporary pages for correctness.
Likely exposure
Exposure is most relevant where Linux systems mount or inspect untrusted EROFS images, such as removable media, firmware images, appliance workflows, or image-processing services. Systems that never process EROFS images have lower practical exposure.
Exploitation context
The bundle lists KEV as false and provides no evidence of active exploitation. The triggering image shape came from fuzzing and is described as impossible for normal mkfs-generated filesystem images.
Researcher notes
Key constraints are incomplete severity data and no CVSS in the supplied bundle. The vulnerability appears availability-focused from a crafted filesystem image, with fixes in Linux stable commits and downstream vendor advisories.
Mitigation direction
Apply vendor kernel updates that include the referenced Linux stable EROFS fixes.
Avoid mounting untrusted EROFS images until patched.
Restrict who can mount filesystem images on shared systems.
Check Siemens advisories for affected Siemens products and product-specific remediation.
Follow distribution vendor guidance for backported kernel fixes.
Validation and detection
Inventory Linux kernel versions across systems and appliances.
Identify systems that mount or scan EROFS images.
Compare running kernels against vendor advisories for CVE-2024-47736.
Review EROFS-related workflows involving removable media or firmware images.
Confirm patched kernels include the referenced stable commits or vendor backports.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-47736 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.