{"id":"CVE-2024-56597","state":"PUBLISHED","title":"jfs: fix shift-out-of-bounds in dbSplit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix shift-out-of-bounds in dbSplit\n\nWhen dmt_budmin is less than zero, it causes errors\nin the later stages. Added a check to return an error beforehand\nin dbAllocCtl itself.","publishedAt":"2024-12-27T14:51:04.184Z","updatedAt":"2026-08-05T11:45:16.339Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"df7c76636952670b31bd6c12b3aed3c502122273","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"6676034aa753aa448beb30dbd75630927ba7cd96","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"51a203470f502a64a3da8dcea51c4748e8267a6c","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"c56245baf3fd1f79145dd7408e3ead034b74255c","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"52756a57e978e2706543a254f88f266cc6702f36","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"]}],"references":["https://git.kernel.org/stable/c/bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e","https://git.kernel.org/stable/c/df7c76636952670b31bd6c12b3aed3c502122273","https://git.kernel.org/stable/c/6676034aa753aa448beb30dbd75630927ba7cd96","https://git.kernel.org/stable/c/51a203470f502a64a3da8dcea51c4748e8267a6c","https://git.kernel.org/stable/c/c56245baf3fd1f79145dd7408e3ead034b74255c","https://git.kernel.org/stable/c/52756a57e978e2706543a254f88f266cc6702f36","https://git.kernel.org/stable/c/a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56597.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56597","state":"PUBLISHED","datePublished":"2024-12-27T14:51:04.184Z","dateUpdated":"2026-08-05T11:45:16.339Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:06.010Z"},"containers":{"cna":{"title":"jfs: fix shift-out-of-bounds in dbSplit","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix shift-out-of-bounds in dbSplit\n\nWhen dmt_budmin is less than zero, it causes errors\nin the later stages. Added a check to return an error beforehand\nin dbAllocCtl itself."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"df7c76636952670b31bd6c12b3aed3c502122273","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"6676034aa753aa448beb30dbd75630927ba7cd96","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"51a203470f502a64a3da8dcea51c4748e8267a6c","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"c56245baf3fd1f79145dd7408e3ead034b74255c","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"52756a57e978e2706543a254f88f266cc6702f36","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","status":"affected","lessThan":"a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e"},{"url":"https://git.kernel.org/stable/c/df7c76636952670b31bd6c12b3aed3c502122273"},{"url":"https://git.kernel.org/stable/c/6676034aa753aa448beb30dbd75630927ba7cd96"},{"url":"https://git.kernel.org/stable/c/51a203470f502a64a3da8dcea51c4748e8267a6c"},{"url":"https://git.kernel.org/stable/c/c56245baf3fd1f79145dd7408e3ead034b74255c"},{"url":"https://git.kernel.org/stable/c/52756a57e978e2706543a254f88f266cc6702f36"},{"url":"https://git.kernel.org/stable/c/a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The poisoned `dmt_budmin` byte only reaches `dbSplit()` after a local mount of an attacker-supplied JFS image or block device, via loop mount or removable media; there is no network or adjacent-network path into the JFS block allocator.\nAC:L - `budmin` is a single s8 field in the on-disk dmap page that the attacker sets directly in the crafted image, and any subsequent block allocation deterministically drives `dbAllocCtl() → dbAllocDmapLev() → dbAllocDmap() → dbAllocBits() → dbSplit()`; no race, timing, or memory-layout condition outside the attacker's control is involved.\nPR:L - An unprivileged local user gets an attacker-crafted image mounted through loop devices or desktop/kiosk automounters (udisks2, systemd) that mount removable media on their behalf, and this is how the repo scores equivalent on-disk validation bugs (CVE-2025-22079, CVE-2024-56692, CVE-2024-58094).\nUI:N - In the automount/loop scenario the attacker performs both the mount and the subsequent write that triggers block allocation, so no separate victim action is required.\nS:U - The corrupted dmap summary tree, the out-of-range indices, and any resulting crash all remain inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The undefined `1 << (cursz - budmin)` shift yields out-of-range buddy indices that are used to index the dmap summary tree, and on the paired free path `dbJoin()` dereferences `leaf[leafno ^ budsz]` with no bounds check at all, giving out-of-bounds reads of kernel memory adjacent to the metapage.\nI:H - Bogus `budsz` values cause `dbAdjTree()` to write attacker-influenced leaf values into wrong slots of the block allocation map, so the same disk blocks can be handed out to both file data and filesystem metadata — arbitrary corruption of on-disk state — and because the shift is undefined behaviour the computed index is not reliably contained.\nA:H - The shift-out-of-bounds is a UBSAN report that panics under `CONFIG_UBSAN_TRAP` or `panic_on_warn`, the `WARN_ON_ONCE` in `dbAdjTree()` is likewise fatal with `panic_on_warn`, and the corrupted allocation state drives `jfs_error()`/filesystem shutdown — all kernel-level denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:45:16.339Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.4.287"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.231"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.174"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:50:30.604Z"}}]}}}