linux-cve-announce - CVE-2023-52805: jfs: fix array-index-out-of-bounds in diAlloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052100-CVE-2023-52805-1338@gregkh>
Date: Tue, 21 May 2024 17:31:41 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52805: jfs: fix array-index-out-of-bounds in diAlloc

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds in diAlloc

Currently there is not check against the agno of the iag while
allocating new inodes to avoid fragmentation problem. Added the check
which is required.

The Linux kernel CVE team has assigned CVE-2023-52805 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.331 with commit 2308d0fb0dc3
	Fixed in 4.19.300 with commit cf7e3e84df36
	Fixed in 5.4.262 with commit 7467ca10a5ff
	Fixed in 5.10.202 with commit 1ba7df5457dc
	Fixed in 5.15.140 with commit 64f062baf202
	Fixed in 6.1.64 with commit 8c68af2af697
	Fixed in 6.5.13 with commit 665b44e55c27
	Fixed in 6.6.3 with commit 1708d0a9917f
	Fixed in 6.7 with commit 05d9ea1ceb62

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52805
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/jfs/jfs_imap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2308d0fb0dc32446b4e6ca37cd09c30374bb64e9
	https://git.kernel.org/stable/c/cf7e3e84df36a9953796c737f080712f631d7083
	https://git.kernel.org/stable/c/7467ca10a5ff09b0e87edf6c4d2a4bfdee69cf2c
	https://git.kernel.org/stable/c/1ba7df5457dc1c1071c5f92ac11323533a6430e1
	https://git.kernel.org/stable/c/64f062baf202b82f54987a3f614a6c8f3e466641
	https://git.kernel.org/stable/c/8c68af2af697ba2ba3b138be0c6d72e2ce3a3d6d
	https://git.kernel.org/stable/c/665b44e55c2767a4f899c3b18f49e9e1c9983777
	https://git.kernel.org/stable/c/1708d0a9917fea579cc9da3d87b154285abd2cd8
	https://git.kernel.org/stable/c/05d9ea1ceb62a55af6727a69269a4fd310edf483