linux-cve-announce - CVE-2023-52804: fs/jfs: Add validity check for db_maxag and db

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052100-CVE-2023-52804-b817@gregkh>
Date: Tue, 21 May 2024 17:31:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52804: fs/jfs: Add validity check for db_maxag and db_agpref

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Add validity check for db_maxag and db_agpref

Both db_maxag and db_agpref are used as the index of the
db_agfree array, but there is currently no validity check for
db_maxag and db_agpref, which can lead to errors.

The following is related bug reported by Syzbot:

UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'

Add checking that the values of db_maxag and db_agpref are valid
indexes for the db_agfree array.

The Linux kernel CVE team has assigned CVE-2023-52804 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.331 with commit a0649e2dd4a3
	Fixed in 4.19.300 with commit ce15b0f1a431
	Fixed in 5.4.262 with commit 32bd8f1cbcf8
	Fixed in 5.10.202 with commit c6c8863fb3f5
	Fixed in 5.15.140 with commit 1f74d336990f
	Fixed in 6.1.64 with commit 5013f8269887
	Fixed in 6.5.13 with commit dca403bb035a
	Fixed in 6.6.3 with commit 2323de34a3ae
	Fixed in 6.7 with commit 64933ab7b048

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52804
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/jfs/jfs_dmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a0649e2dd4a3595b5595a29d0064d047c2fae2fb
	https://git.kernel.org/stable/c/ce15b0f1a431168f07b1cc6c9f71206a2db5c809
	https://git.kernel.org/stable/c/32bd8f1cbcf8b663e29dd1f908ba3a129541a11b
	https://git.kernel.org/stable/c/c6c8863fb3f57700ab583d875adda04caaf2278a
	https://git.kernel.org/stable/c/1f74d336990f37703a8eee77153463d65b67f70e
	https://git.kernel.org/stable/c/5013f8269887642cca784adc8db9b5f0b771533f
	https://git.kernel.org/stable/c/dca403bb035a565bb98ecc1dda5d30f676feda40
	https://git.kernel.org/stable/c/2323de34a3ae61a9f9b544c18583f71cea86721f
	https://git.kernel.org/stable/c/64933ab7b04881c6c18b21ff206c12278341c72e