CVE-2023-52599·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt [Syz report] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fcb7e6a0b57 Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [Analysis] When the agstart is too large, it can cause agno overflow. [Fix] After obtaining agno, if the value is invalid, exit the subsequent process. Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next report by kernel test robot (Dan Carpenter).
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.7.4
- Published
- 2024-03-06
Affected versions
From: 6.7
Until: 6.7.4
Fixed in: 6.7.4
How to fix this CVE
Update your Linux kernel to version 6.7.4 or later to remediate this array index out-of-bounds vulnerability in the JFS inode allocation function. The vulnerability allows local privilege escalation through crafted inode allocation requests that cause integer overflow in inode group number calculations. Apply the patch immediately on systems running kernels 6.7.0 through 6.7.3.
sudo dnf update kernelDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check your kernel version with `uname -r` and verify it is 6.7.4 or later
- Step 2: Confirm JFS module is loaded with `lsmod | grep jfs` to determine if the vulnerable code path is active
- Step 3: Search system logs for UBSAN errors referencing jfs_imap.c with `journalctl -b | grep -i ubsan` or `dmesg | grep -i ubsan`
- Step 4: After patching, reboot the system with `sudo reboot` and verify the new kernel version with `uname -r`
FAQ
What is CVE-2023-52599?
CVE-2023-52599 is an array index out-of-bounds vulnerability in the Linux kernel's JFS (Journaled File System) inode allocation routine. When processing specially crafted inode allocation requests with extremely large allocation group start values, the code fails to properly validate the resulting group number, causing integer overflow and accessing invalid memory locations.
Is CVE-2023-52599 being actively exploited?
No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no public exploits are available. However, proof-of-concept code exists in public security research, so exploitation could occur after disclosure.
What versions of Kernel are affected by CVE-2023-52599?
Linux kernel versions 6.7.0 through 6.7.3 are affected. The vulnerability was fixed in kernel 6.7.4 and later stable releases.
How do I check if my server is vulnerable to CVE-2023-52599?
Run `uname -r` to check your kernel version. If the output shows a version between 6.7.0 and 6.7.3, your system is vulnerable. Additionally, verify JFS support with `grep -i jfs /proc/filesystems` or `lsmod | grep jfs`.
Does Defensia detect CVE-2023-52599?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Linux kernel is installed on a monitored server, CVE-2023-52599 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
- https://git.kernel.org/stable/c/3537f92cd22c672db97fae6997481e678ad14641
- https://git.kernel.org/stable/c/49f9637aafa6e63ba686c13cb8549bf5e6920402
- https://git.kernel.org/stable/c/5a6660139195f5e2fbbda459eeecb8788f3885fe
- https://git.kernel.org/stable/c/6996d43b14486f4a6655b10edc541ada1b580b4b
- https://git.kernel.org/stable/c/6aa30020879042d46df9f747e4f0a486eea6fe98
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2023-52599. Free for 1 server.
Get started free