CVE-2023-52601

What it actually does

Missing bounds check in dbAdjTree allows out-of-bounds array access into dmt_stree when is_ctl is not used to size the structure correctly, resulting in memory corruption.

Why it matters to the business

Local attackers can trigger kernel crashes or memory corruption on systems using the JFS filesystem, leading to denial of service, potential privilege escalation, and unplanned downtime on Linux servers and devices.

How an attack unfolds

An attacker with local access crafts JFS filesystem metadata or operations that reach dbAdjTree with an index exceeding the dmt_stree bounds; the absent is_ctl check permits the invalid access, potentially allowing read/write outside the array for corruption or code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 3d3898b4d72c677d47fe3cb554449f2df5c12555 or later; rebuild and reboot affected systems; disable JFS if unused.

How to confirm the fix worked

Confirm the running kernel contains commit 3d3898b4d72c677d47fe3cb554449f2df5c12555 via uname or git describe; attempt to reproduce the original out-of-bounds condition with test cases from the referenced patch discussion.

Typical attack path

1. Obtain local user access on a Linux system using JFS
2. Trigger dbAdjTree via crafted disk map tree operations or metadata
3. Supply an index that bypasses the missing bounds check
4. Achieve out-of-bounds memory read or write
5. Escalate to kernel-level impact or cause crash

How to detect it

Review kernel logs for JFS-related oops or panic messages referencing dbAdjTree or dmt_stree; inspect audit logs for unusual JFS mount or filesystem operations by non-privileged users.

What your security team should do

• Prioritize patching all production Linux systems using JFS within the next maintenance window
• Audit systems for JFS usage and migrate to supported filesystems where possible
• Enable kernel hardening features such as KASAN in test environments to catch similar issues
• Monitor for new stable kernel releases containing the fix