CVE-2023-52602

What it actually does

Out-of-bounds read in the JFS dtSearch function when traversing the sorted entry table of a directory page, allowing a local process to access kernel slab memory beyond allocated bounds.

Why it matters to the business

Linux systems using the JFS filesystem face risk of kernel crashes or limited kernel memory disclosure from local users, potentially disrupting services or exposing sensitive data in shared environments.

How an attack unfolds

An attacker with local access crafts or supplies a malicious JFS filesystem image containing specially arranged directory entries that trigger the missing bounds check during dtSearch, causing the kernel to read past the end of the entry table and return -EIO on detection.

How to fix it

Upgrade the Linux kernel to a version containing commit ce8bc22e948634a5c0a3fa58a179177d0e3f3950 which adds the required bounds check in dtSearch and returns -EIO on error.

How to confirm the fix worked

Confirm the running kernel includes commit ce8bc22e948634a5c0a3fa58a179177d0e3f3950 or later equivalent; test by attempting directory operations on JFS volumes and verify no slab OOB warnings are logged.

Typical attack path

1. Obtain local shell or user context on a Linux system with JFS support
2. Mount or access a crafted JFS volume containing out-of-bounds directory entry layout
3. Trigger directory search operations that invoke dtSearch on the malformed page
4. Kernel performs slab read beyond allocated entry table bounds
5. Exploit outcome limited to information leak or denial of service via kernel fault

How to detect it

Review kernel logs for slab allocation warnings or JFS dtSearch errors; inspect mounted JFS volumes for unexpected directory structures; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates containing ce8bc22e948634a5c0a3fa58a179177d0e3f3950 on all systems using JFS
• Disable JFS module if the filesystem is not required
• Monitor kernel logs for slab-out-of-bounds warnings related to dtSearch