CVE-2023-52804

What it actually does

Missing validity checks on db_maxag and db_agpref allow out-of-bounds indexing into the db_agfree array in fs/jfs/jfs_dmap.c, resulting in array-index-out-of-bounds errors and potential buffer overflow conditions.

Why it matters to the business

May cause kernel panics, filesystem corruption, or limited code execution on systems using the JFS filesystem, increasing downtime risk in affected environments despite low exploitation probability and no active ransomware usage.

How an attack unfolds

An attacker supplies crafted or fuzzed JFS metadata that sets db_maxag or db_agpref beyond the valid range for the 128-element array; subsequent access in jfs_dmap.c triggers the out-of-bounds condition, which can be leveraged for denial of service or memory corruption.

How to fix it

Apply the upstream kernel patch that adds validity checks for db_maxag and db_agpref; update to a fixed kernel release containing commit addressing the JFS dmap bounds issue.

How to confirm the fix worked

Confirm presence of the bounds-checking patch in the running kernel source or verify that db_maxag/db_agpref are validated before use as db_agfree indexes.

Typical attack path

1. Mount or operate on a JFS volume containing maliciously crafted metadata
2. db_maxag or db_agpref values exceed array bounds during dmap processing
3. Out-of-bounds array access occurs in jfs_dmap.c leading to crash or corruption

How to detect it

Search kernel logs and crash reports for UBSAN array-index-out-of-bounds messages referencing fs/jfs/jfs_dmap.c and atomic_t array access.

• UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
• index .* is out of range for type 'atomic_t[128]'

What your security team should do

• Prioritize kernel updates on systems using JFS
• Disable JFS if not required
• Monitor kernel logs for UBSAN array-index-out-of-bounds reports in jfs_dmap.c