In the Linux kernel, the following vulnerability has been resolved:
jfs: jfsdmap: Validate dbl2nbperpage while mounting
In jfsdmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). dbl2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size)
=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
[
{
"id": "CVE-2023-53222-1078ae6a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11509910c599cbd04585ec35a6d5e1a0053d84c1",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-10bd0928",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de984faecddb900fa850af4df574a25b32bb93f5",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-193e2221",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b7eaae08e8b2f25bdf37bc14d21be090bcb20f",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-212f9fb1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4855aeb13e4ad1f23e16753b68212e180f7d848",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-55543a5d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c1efe3f74a7864461b0dff281c5562154b4aa8e",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-615f176b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4855aeb13e4ad1f23e16753b68212e180f7d848",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-75596b8a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-7ae9b629",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c1efe3f74a7864461b0dff281c5562154b4aa8e",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-7cdc884e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7feb54b113802d2aba98708769d3c33fb017254",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-8ddc5cb0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a03c4e683d33d17b667418eb717b13dda1fac6b",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-914d1d0f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47b7eaae08e8b2f25bdf37bc14d21be090bcb20f",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-b63226b9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a03c4e683d33d17b667418eb717b13dda1fac6b",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-b8f938d7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-c57053e9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7feb54b113802d2aba98708769d3c33fb017254",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-cfac78ae",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de984faecddb900fa850af4df574a25b32bb93f5",
"digest": {
"length": 1803.0,
"function_hash": "144511548878339241061301746409477057213"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "dbMount",
"file": "fs/jfs/jfs_dmap.c"
}
},
{
"id": "CVE-2023-53222-dd9ed07c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11509910c599cbd04585ec35a6d5e1a0053d84c1",
"digest": {
"line_hashes": [
"167037719346424972433350018782565435386",
"56544252226074386012127450392676636109",
"39374577308485970826568184184851867450",
"296654402011312963108493474565062660921",
"310352123703932241168079803496240829440"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dmap.c"
}
}
]