CVE-2023-52604

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52604
In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 Patch
https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 Patch
https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd Patch
https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b Patch
https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 Patch
https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 Patch
https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b Patch
https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 Patch
https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 Patch
https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 Patch
https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd Patch
https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b Patch
https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 Patch
https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 Patch
https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b Patch
https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Dec 2024, 17:49

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 - () https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 - Patch
References () https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 - () https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 - Patch
References () https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd - () https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd - Patch
References () https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b - () https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b - Patch
References () https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 - () https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 - Patch
References () https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 - () https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 - Patch
References () https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b - () https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b - Patch
References () https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 - () https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Patch
First Time Linux
Linux linux Kernel
CWE CWE-129
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 08:40

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 - () https://git.kernel.org/stable/c/42f433785f108893de0dd5260bafb85d7d51db03 -
References () https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 - () https://git.kernel.org/stable/c/59342822276f753e49d27ef5eebffbba990572b9 -
References () https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd - () https://git.kernel.org/stable/c/6a44065dd604972ec1fbcccbdc4a70d266a89cdd -
References () https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b - () https://git.kernel.org/stable/c/6fe8b702125aeee6ce83f20092a2341446704e7b -
References () https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 - () https://git.kernel.org/stable/c/9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 -
References () https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 - () https://git.kernel.org/stable/c/98f9537fe61b8382b3cc5dd97347531698517c56 -
References () https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b - () https://git.kernel.org/stable/c/de34de6e57bbbc868e4fcf9e98c76b3587cabb0b -
References () https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 - () https://git.kernel.org/stable/c/e3e95c6850661c77e6dab079d9b5374a618ebb15 -

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

06 Mar 2024, 15:18

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: FS:JFS:UBSAN:array-index-out-of-bounds en dbAdjTree Syzkaller informó el siguiente problema: UBSAN: array-index-out-of-bounds en fs/jfs /jfs_dmap.c:2867:6 el índice 196694 está fuera del rango para el tipo 's8[1365]' (también conocido como 'carácter firmado[1365]') CPU: 1 PID: 109 Comm: jfsCommit No contaminado 6.6.0-rc3-syzkaller #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/08/2023 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:88 [en línea] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [en línea] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs _dmap.c: 2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [en línea] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/j fs /jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [en línea] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x3 70 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 ============== ==================================================== ================ Pánico del kernel: no se sincroniza: UBSAN: pánico_on_warn configurado... CPU: 1 PID: 109 Comm: jfsCommit No contaminado 6.6.0-rc3-syzkaller #0 Hardware nombre: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/08/2023 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:88 [en línea] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 pánico+0x30f /0x770 Kernel/Panic.C: 340 check_panic_on_warn+0x82/0xa0 kernel/Panic.c: 236 UBSAN_EPILOGO LIB/UBSAN.C: 223 [Inline] __ubsan_handle_out_of_bounds+0x13c/0x150 LIB/UB/UBSAN.C: 4F0 FS /jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [en línea] dbFree +0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [en línea] jf s_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64. S:304 Desplazamiento del kernel: deshabilitado Reinicio en 86400 segundos. El problema se produce cuando el valor de lp se vuelve mayor que CTLTREESIZE, que es el tamaño máximo de stree. Agregar una verificación simple resuelve este problema. Dave: Como la función devuelve un valor nulo, un buen manejo de errores requeriría una reorganización del código más intrusiva, así que modifiqué el parche de Osama en use WARN_ON_ONCE por falta de una opción más limpia. El parche se prueba mediante syzbot.

06 Mar 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-06 07:15

Updated : 2024-12-12 17:49

NVD link : CVE-2023-52604

Mitre link : CVE-2023-52604

CVE.ORG link : CVE-2023-52604

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index