Description
In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbAllocAG Syzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The underlying bug is the missing check of bmp->db_agl2size. The field can be greater than 64 and trigger the shift-out-of-bounds. Fix this bug by adding a check of bmp->db_agl2size in dbMount since this field is used in many following functions. The upper bound for this field is L2MAXL2SIZE - L2MAXAG, thanks for the help of Dave Kleikamp. Note that, for maintenance, I reorganized error handling code of dbMount.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d3b486946a4e62c7ef6023f7d9c1d049051384baaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3115313cf03113e87c87adee18ee49a20bbdb9baaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < eea87acb6027be3dd4d3c57186bb22800d57fddaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 359616ce587e524107730504891afa4b1a8be58caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3e997e4ce8ae7ab89d72334120f6aee49c5bbdbdaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0536f76a2bca83d1a3740517ba22cc93a44b3099affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2c575c8905f7a8b32d5611b91856b69bac2a5bf1affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 67973caae78e21ee46a7281aaa8ca364eb9c444faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 898f706695682b9954f280d95e49fa86ffa55d08affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.9.337 to ≤ 4.9.*unaffected4.14.303 to ≤ 4.14.*unaffected4.19.270 to ≤ 4.19.*unaffected5.4.229 to ≤ 5.4.*unaffected5.10.163 to ≤ 5.10.*unaffected5.15.86 to ≤ 5.15.*unaffected6.0.16 to ≤ 6.0.*unaffected6.1.2 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d3b486946a4e62c7ef6023f7d9c1d049051384ba ↗
- https://git.kernel.org/stable/c/3115313cf03113e87c87adee18ee49a20bbdb9ba ↗
- https://git.kernel.org/stable/c/eea87acb6027be3dd4d3c57186bb22800d57fdda ↗
- https://git.kernel.org/stable/c/359616ce587e524107730504891afa4b1a8be58c ↗
- https://git.kernel.org/stable/c/3e997e4ce8ae7ab89d72334120f6aee49c5bbdbd ↗
- https://git.kernel.org/stable/c/0536f76a2bca83d1a3740517ba22cc93a44b3099 ↗
- https://git.kernel.org/stable/c/2c575c8905f7a8b32d5611b91856b69bac2a5bf1 ↗
- https://git.kernel.org/stable/c/67973caae78e21ee46a7281aaa8ca364eb9c444f ↗
- https://git.kernel.org/stable/c/898f706695682b9954f280d95e49fa86ffa55d08 ↗