{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50333", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-15T14:18:36.816Z", "datePublished": "2025-09-15T14:49:46.222Z", "dateUpdated": "2026-08-05T08:58:15.308Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:15.308Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: fix shift-out-of-bounds in dbDiscardAG\n\nThis should be applied to most URSAN bugs found recently by syzbot,\nby guarding the dbMount. As syzbot feeding rubbish into the bmap\ndescriptor." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only by mounting a crafted JFS block device/image so dbMount loads attacker-controlled bmap fields; there is no network or adjacent-protocol entry into fs/jfs.\nAC:L - A malicious on-disk bmap with (mapsize-1)>>agl2size > MAXAG deterministically yields out-of-range AG indices and triggers OOB db_agfree access / shift UB on FITRIM or allocation; the attacker fully controls that layout with no race.\nPR:N - The attacker needs no account on the target—only a malicious JFS image (USB stick, disk/container image, or media presented to udisks2/automount on desktops, kiosks, or embedded systems).\nUI:R - jfs is FS_REQUIRES_DEV without FS_USERNS_MOUNT, so CAP_SYS_ADMIN is required to mount; a victim or automount daemon must mount the attacker-supplied volume before the OOB path runs.\nS:U - Impact is host-kernel heap OOB on the in-memory bmap descriptor under the same OS security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Invalid AG counts cause out-of-bounds reads of bmp->db_agfree[agno] (and related AG state) past MAXAG; per guidance OOB reads are Confidentiality High.\nI:H - Allocation/free paths perform bmp->db_agfree[agno] -= / += nblocks with attacker-influenced agno, corrupting adjacent bmap heap fields and enabling write/control-flow primitives; OOB write is Integrity High.\nA:H - The demonstrated UBSAN shift-out-of-bounds in dbDiscardAG and OOB AG indexing can oops/panic the kernel, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/jfs_dmap.c" ], "versions": [ { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "f8d4d0bac603616e2fa4a3907e81ed13f8f3c380", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "0183c8f46ab5bcd0740f41c87f5141c6ca2bf1bb", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "624843f1bac448150f6859999c72c4841c14a2e3", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "50163a115831ef4e6402db5a7ef487d1989d7249", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "911999b193735cd378517b6cd5fe585ee345d49c", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "10b87da8fae79c7daf5eda6a9e4f1d31b85b4d92", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "ab5cd3d62c2493eca3337e7d0178cc7bd819ca64", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "3d340b684dcec5e34efc470227cd1c7d2df121ad", "status": "affected", "versionType": "git" }, { "version": "b40c2e665cd552eae5fbdbb878bc29a34357668e", "lessThan": "25e70c6162f207828dd405b432d8f2a98dbf7082", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/jfs_dmap.c" ], "versions": [ { "version": "3.7", "status": "affected" }, { "version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver" }, { "version": "4.9.337", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.303", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.270", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.229", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.163", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.86", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.9.337" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.14.303" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.19.270" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.4.229" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.86" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.0.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f8d4d0bac603616e2fa4a3907e81ed13f8f3c380" }, { "url": "https://git.kernel.org/stable/c/0183c8f46ab5bcd0740f41c87f5141c6ca2bf1bb" }, { "url": "https://git.kernel.org/stable/c/624843f1bac448150f6859999c72c4841c14a2e3" }, { "url": "https://git.kernel.org/stable/c/50163a115831ef4e6402db5a7ef487d1989d7249" }, { "url": "https://git.kernel.org/stable/c/911999b193735cd378517b6cd5fe585ee345d49c" }, { "url": "https://git.kernel.org/stable/c/10b87da8fae79c7daf5eda6a9e4f1d31b85b4d92" }, { "url": "https://git.kernel.org/stable/c/ab5cd3d62c2493eca3337e7d0178cc7bd819ca64" }, { "url": "https://git.kernel.org/stable/c/3d340b684dcec5e34efc470227cd1c7d2df121ad" }, { "url": "https://git.kernel.org/stable/c/25e70c6162f207828dd405b432d8f2a98dbf7082" } ], "title": "fs: jfs: fix shift-out-of-bounds in dbDiscardAG", "x_generator": { "engine": "bippy-1.2.0" } } } }