CVE-2023-52810

What it actually does

Negative db_l2nbperpage value in JFS is used as a shift exponent in fs/jfs/jfs_dmap.c:799, triggering UBSAN shift-out-of-bounds when the exponent is negative.

Why it matters to the business

Local denial of service or kernel instability on systems using the JFS filesystem; low public exploit activity and no ransomware use reduce immediate operational risk despite high CVSS.

How an attack unfolds

An attacker with local access crafts or mounts a malformed JFS filesystem image that sets a negative l2nbperpage value; when the kernel processes the dmap structure the negative shift triggers the bounds error, leading to a crash or undefined behavior.

How to fix it

Apply the upstream fix that enforces a minimum value of zero for l2nbperpage; for ktorio/ktor update to commit c751ca814af68efe754fba7c7f4027d1b7ff7933.

How to confirm the fix worked

Confirm the patched kernel no longer accepts negative l2nbperpage and that UBSAN reports are absent under the same input; verify the exact fixed commit is present in deployed ktorio/ktor builds.

Typical attack path

1. Obtain local access to a Linux system using JFS
2. Prepare a filesystem image with negative l2nbperpage
3. Mount or otherwise trigger JFS dmap processing
4. Trigger the shift operation in jfs_dmap.c to cause the out-of-bounds condition

How to detect it

Review kernel logs for UBSAN shift-out-of-bounds messages referencing fs/jfs/jfs_dmap.c; inspect mounts and filesystem images for anomalous l2nbperpage values.

What your security team should do

• Prioritize patching Linux kernels that include JFS support within normal maintenance windows given low EPSS
• Audit systems for JFS usage and remove the filesystem where not required
• Monitor for any future EPSS increase or KEV addition
• Update ktorio/ktor to the listed commit if the project is in use