Description
In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8c1efe3f74a7864461b0dff281c5562154b4aa8eaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a4855aeb13e4ad1f23e16753b68212e180f7d848affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 47b7eaae08e8b2f25bdf37bc14d21be090bcb20faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < de984faecddb900fa850af4df574a25b32bb93f5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c7feb54b113802d2aba98708769d3c33fb017254affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2a03c4e683d33d17b667418eb717b13dda1fac6baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 11509910c599cbd04585ec35a6d5e1a0053d84c1affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.14.322 to ≤ 4.14.*unaffected4.19.291 to ≤ 4.19.*unaffected5.4.251 to ≤ 5.4.*unaffected5.10.188 to ≤ 5.10.*unaffected5.15.121 to ≤ 5.15.*unaffected6.1.40 to ≤ 6.1.*unaffected6.4.5 to ≤ 6.4.*unaffected6.5 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8c1efe3f74a7864461b0dff281c5562154b4aa8e ↗
- https://git.kernel.org/stable/c/ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2 ↗
- https://git.kernel.org/stable/c/a4855aeb13e4ad1f23e16753b68212e180f7d848 ↗
- https://git.kernel.org/stable/c/47b7eaae08e8b2f25bdf37bc14d21be090bcb20f ↗
- https://git.kernel.org/stable/c/de984faecddb900fa850af4df574a25b32bb93f5 ↗
- https://git.kernel.org/stable/c/c7feb54b113802d2aba98708769d3c33fb017254 ↗
- https://git.kernel.org/stable/c/2a03c4e683d33d17b667418eb717b13dda1fac6b ↗
- https://git.kernel.org/stable/c/11509910c599cbd04585ec35a6d5e1a0053d84c1 ↗