CVE-2023-52603
Linux Kernel JFS dtSplitRoot Array Index Out of Bounds Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot.
INFO
Published Date :
March 6, 2024, 7:15 a.m.
Last Modified :
Dec. 12, 2024, 5:36 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52603.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52603 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52603 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 12, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE NIST CWE-129 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.307 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.77 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.4 Changed Reference Type https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 No Types Assigned https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 Patch Changed Reference Type https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 No Types Assigned https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 Patch Changed Reference Type https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 No Types Assigned https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 Patch Changed Reference Type https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 No Types Assigned https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 Patch Changed Reference Type https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 No Types Assigned https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 Patch Changed Reference Type https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 No Types Assigned https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 Patch Changed Reference Type https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af No Types Assigned https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af Patch Changed Reference Type https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af No Types Assigned https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af Patch Changed Reference Type https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 No Types Assigned https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 Patch Changed Reference Type https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 No Types Assigned https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 Patch Changed Reference Type https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 No Types Assigned https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 Patch Changed Reference Type https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 No Types Assigned https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 Patch Changed Reference Type https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f No Types Assigned https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f Patch Changed Reference Type https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f No Types Assigned https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f Patch Changed Reference Type https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 No Types Assigned https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 Patch Changed Reference Type https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 No Types Assigned https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 Added Reference https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 Added Reference https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 Added Reference https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af Added Reference https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 Added Reference https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 Added Reference https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f Added Reference https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 04, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 06, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Added Reference Linux https://git.kernel.org/stable/c/e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/fd3486a893778770557649fe28afa5e463d4ed07 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e4ce01c25ccbea02a09a5291c21749b1fc358e39 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/e4cbc857d75d4e22a1f75446e7480b1f305d8d60 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/edff092a59260bf0b0a2eba219cb3da6372c2f9f [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/6e2902ecc77e9760a9fc447f56d598383e2372d2 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52603 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52603
weaknesses.