7.1

CVE-2024-33847: linux

CVSS: 7.1v3.1HighModified
AliasesUBUNTU-CVE-2024-33847DEBIAN-CVE-2024-33847
Published 24-06-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-33847 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.23%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 13
DSA-5730-1MGASA-2024-0263MGASA-2024-0266USN-6999-1USN-6999-2USN-7004-1

Timeline

  1. 24-06-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: don't allow unaligned truncation on released compress inode f2fs image may be corrupted after below testcase: - mkfs.f2fs -O extra_attr,compression -f /dev/vdb - mount /dev/vdb /mnt/f2fs - touch /mnt/f2fs/file - f2fs_io setflags compression /mnt/f2fs/file - dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4 - f2fs_io release_cblocks /mnt/f2fs/file - truncate -s 8192 /mnt/f2fs/file - umount /mnt/f2fs - fsck.f2fs /dev/vdb [ASSERT] (fsck_chk_inode_blk:1256) --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks [FSCK] valid_block_count matching with CP [Fail] [0x4, 0x5] [FSCK] other corrupted bugs [Fail] The reason is: partial truncation assume compressed inode has reserved blocks, after partial truncation, valid block count may change w/o .i_blocks and .total_valid_block_count update, result in corruption. This patch only allow cluster size aligned truncation on released compress inode for fixing.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

0.00 pp

From 0.23% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu116 products
  • linux< 5.15.0-121.131 | < 6.8.0-44.44
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1069.75 | < 6.8.0-1015.16
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 8e1651cd667cd6779db28314844d88b6de8312a3, < b8962cf98595d1ec62f40f23667de830567ec8bc | ≥ c61404153eb683da9c35aad133131554861ed561, < 8acae047215024d1ac499b3c8337ef1b952f160b | ≥ c61404153eb683da9c35aad133131554861ed561, < 3ccf5210dc941a7aa0180596ac021568be4d35ec | ≥ c61404153eb683da9c35aad133131554861ed561, < 9f9341064a9b5246a32a7fe56b9f80c6f7f3c62d | ≥ c61404153eb683da9c35aad133131554861ed561, < 5268241b41b1c5d0acca75e9b97d4fd719251c8c | ≥ c61404153eb683da9c35aad133131554861ed561, < 29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee | 5.14
  • linux_kernel≥ 5.14, < 5.15.161 | ≥ 5.16, < 6.1.93 | ≥ 6.2, < 6.6.33 | ≥ 6.7, < 6.9.4
Debian1 product
  • linux< 6.1.94-1 | < 6.9.7-1

3 vendors · 119 products

References

24 links
Show all 24 references