CVE-2024-47723

What it actually does

Missing bounds checks on bmp->db_numag, agpref, and agno in JFS dbMount(), dbNextAG(), and diAlloc() permit out-of-bounds memory reads/writes when a filesystem image supplies values >= MAXAG.

Why it matters to the business

Linux servers and appliances using the JFS filesystem can crash or leak kernel memory when an attacker supplies a malicious disk image, increasing downtime and forensic costs across the installed base.

How an attack unfolds

An attacker creates a JFS image with an inflated db_numag value, convinces the target to mount it (or triggers automatic mount), and causes dbNextAG() or diAlloc() to index beyond allocated arrays, resulting in kernel memory corruption or disclosure.

How to fix it

Upgrade the Linux kernel to commit d1017d2a0f3f16dc1db5120e7ddbe7c6680425b0 or later stable releases that add the required bounds checks in dbMount(), dbNextAG(), and diAlloc().

How to confirm the fix worked

Confirm the running kernel contains commit d1017d2a0f3f16dc1db5120e7ddbe7c6680425b0; attempt to mount a test image with db_numag set to MAXAG and verify no panic or OOB occurs.

Typical attack path

1. Craft a JFS filesystem image with bmp->db_numag >= MAXAG
2. Place the image on removable media, network share, or block device accessible to the victim
3. Trigger mount of the malicious image (manual or via udev/fstab)
4. dbMount() and subsequent dbNextAG()/diAlloc() calls perform unchecked array indexing
5. Kernel OOB read/write occurs, enabling crash or memory disclosure

How to detect it

Search kernel logs and dmesg for JFS-related oops/panic messages referencing dbNextAG, diAlloc, or dbMount; inspect mount attempts of external JFS volumes in audit logs.

• dbNextAG
• diAlloc
• dbMount
• jfs: out-of-bounds

What your security team should do

• Apply the fixed kernel commit immediately on all systems that may mount untrusted JFS volumes
• Disable JFS support in kernel config if the filesystem is not required
• Monitor for kernel oops containing JFS function names after any untrusted mount