CVE-2023-52599

What it actually does

Out-of-bounds array access in fs/jfs/jfs_imap.c:2360 when agno calculation overflows MAXAG due to oversized agstart, allowing invalid indexing into iagctl[128] during inode allocation in diNewExt called from mkdir paths.

Why it matters to the business

Systems using the JFS filesystem on Linux kernels may experience crashes, filesystem corruption, or denial of service during directory creation operations; low exploitability and absence from known campaigns reduce immediate risk but require prompt patching on affected deployments.

How an attack unfolds

An attacker with local access crafts or mounts a JFS image with large agstart values and issues a mkdir syscall; this reaches diAllocAG, computes an invalid agno, and triggers the out-of-bounds read/write in diNewExt before the added bounds check can exit early.

How to fix it

Update the Linux kernel to a version containing commit f423528488e4f9606cef858eceea210bf1163f41 or later; rebuild and reboot with the patched kernel; disable JFS module if unused.

How to confirm the fix worked

Verify kernel source contains the bounds check (agno >= MAXAG) after agno derivation in jfs_imap.c; confirm running kernel version includes the fix; run syzkaller or similar reproducer to ensure no crash on mkdir with large agstart.

Typical attack path

1. Obtain local code execution or shell on target Linux system
2. Prepare or mount a JFS filesystem image containing an oversized agstart value
3. Invoke mkdir (or equivalent VFS operation) on the mounted JFS volume
4. Trigger diAlloc -> diAllocAG -> diNewExt path with overflowed agno
5. Cause UBSAN-detected array-index-out-of-bounds or subsequent memory corruption

How to detect it

Search kernel logs for UBSAN array-index-out-of-bounds messages referencing jfs_imap.c:2360 or diNewExt; inspect auditd or syscall logs for unusual mkdir activity on JFS mounts immediately preceding crashes; no widespread threat actor exploitation reported.

What your security team should do

• Prioritize kernel upgrade on any system mounting JFS volumes
• Audit for JFS usage via /proc/filesystems and mount output
• Apply the referenced commit or distribution backport within standard patch windows given low EPSS
• Monitor for future similar bounds issues in other filesystem inode allocators