In the Linux kernel, the following vulnerability has been resolved:
jfs: jfsdmap: Validate dbl2nbperpage while mounting
In jfsdmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). dbl2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size)
=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de984faecddb900fa850af4df574a25b32bb93f5",
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"id": "CVE-2023-53222-10bd0928"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7feb54b113802d2aba98708769d3c33fb017254",
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"id": "CVE-2023-53222-7cdc884e"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7feb54b113802d2aba98708769d3c33fb017254",
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"id": "CVE-2023-53222-c57053e9"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de984faecddb900fa850af4df574a25b32bb93f5",
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"id": "CVE-2023-53222-cfac78ae"
}
]