CVE-2023-52603

What it actually does

Out-of-bounds array access in fs/jfs/jfs_dtree.c:dtSplitRoot when fsi becomes less than -1, bypassing the existing -1 loop termination check and indexing into struct dtslot[128] with a negative value.

Why it matters to the business

Systems using the JFS filesystem risk kernel crashes, memory corruption, or denial of service during directory creation operations; widespread Linux kernel deployments increase exposure across servers and embedded devices.

How an attack unfolds

A local attacker invokes mkdirat on a JFS volume under conditions that drive the fsi index below -1 inside dtSplitRoot during dtSplitUp, triggering the UBSAN out-of-bounds handler or raw memory corruption; the flaw was originally discovered via syzkaller fuzzing of the kernel.

How to fix it

Upgrade the Linux kernel to the commit e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af or later; apply the vendor-supplied backport that adds a check for values less than zero in the dtSplitRoot loop.

How to confirm the fix worked

Verify the running kernel contains commit e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af; reproduce the original syzkaller test case and confirm absence of the UBSAN report; inspect fs/jfs/jfs_dtree.c for the added negative-value guard.

Typical attack path

1. Mount or access a JFS filesystem
2. Craft directory creation parameters that force repeated splits in the directory tree
3. Trigger dtInsert -> dtSplitUp -> dtSplitRoot with a negative fsi value
4. Cause array-index-out-of-bounds or kernel panic

How to detect it

Search kernel logs and dmesg for UBSAN reports containing 'array-index-out-of-bounds in fs/jfs/jfs_dtree.c', 'index -2 is out of range for type struct dtslot', and process names such as syz-executor; correlate with mkdirat or jfs_mkdir call traces.

• array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971
• index -2 is out of range for type 'struct dtslot [128]'
• dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c
• UBSAN: array-index-out-of-bounds

What your security team should do

• Prioritize kernel upgrades on all systems hosting JFS volumes within the next patch cycle
• Disable JFS module loading via modprobe blacklist where JFS is not required
• Monitor kernel logs for UBSAN array-index-out-of-bounds messages referencing jfs_dtree.c
• Review and restrict unprivileged local user access to JFS filesystems