{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-52799", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T15:19:24.246Z", "datePublished": "2024-05-21T15:31:12.351Z", "dateUpdated": "2026-08-05T09:11:27.824Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:11:27.824Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbFindLeaf\n\nCurrently while searching for dmtree_t for sufficient free blocks there\nis an array out of bounds while getting element in tp->dm_stree. To add\nthe required check for out of bound we first need to determine the type\nof dmtree. Thus added an extra parameter to dbFindLeaf so that the type\nof tree can be determined and the required check can be applied." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through local VFS operations on a mounted JFS filesystem (e.g. mkdirat → jfs_mkdir → dtInsert → dbAlloc → dbFindLeaf); it is not reachable via network packet processing.\nAC:L - A crafted or corrupted dmap/dmapctl tree with an attacker-controlled dmt_height reliably drives the stree walk out of bounds with ordinary file-creating syscalls; no race or other condition outside the attacker’s control is required.\nPR:L - Once a writable JFS volume is mounted, an unprivileged local user with write access can trigger the path via mkdir/creat; this matches sibling JFS OOB CVEs (CVE-2023-52804/52805/52810) scored PR:L.\nUI:N - The attacker triggers the vulnerability directly through their own syscalls on the mounted filesystem; no separate victim interaction is required.\nS:U - Impact is confined to the host kernel’s JFS/block-allocator authority (memory safety / DoS / privilege escalation within that kernel); it does not cross a VM, IOMMU, or other security boundary.\nC:H - Attacker-controlled dmt_height makes the stree index grow without a bound check, so the out-of-bounds read can extend past the metapage into adjacent kernel memory, enabling disclosure beyond a few bounded bytes.\nI:H - A corrupted leafidx from the OOB walk is consumed by dbAllocDmapLev/dbAllocBits to update allocation bitmaps and tree nodes, yielding kernel-memory and metadata corruption that can be leveraged for integrity compromise; choose High under uncertainty.\nA:H - The out-of-bounds access can oops/fault on unmapped memory, and the subsequent assert(n < 4) path calls BUG(), producing a hard kernel availability loss as demonstrated by the syzbot crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/jfs_dmap.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "20f9310a18e3e99fc031e036fcbed67105ae1859", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "86df90f3fea7c5591f05c8a0010871d435e83046", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ecfb47f13b08b02cf28b7b50d4941eefa21954d2", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "81aa58cd8495b8c3b527f58ccbe19478d8087f61", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "da3da5e1e6f71c21d8e6149d7076d936ef5d4cb9", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "a50b796d36719757526ee094c703378895ab5e67", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "88b7894a8f8705bf4e7ea90b10229376abf14514", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "87c681ab49e99039ff2dd3e71852417381b13878", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "22cad8bc1d36547cdae0eef316c47d917ce3147c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/jfs_dmap.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.331", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.300", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.262", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.202", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.140", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.64", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.13", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.3", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "4.14.331" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "4.19.300" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.262" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.5.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/20f9310a18e3e99fc031e036fcbed67105ae1859" }, { "url": "https://git.kernel.org/stable/c/86df90f3fea7c5591f05c8a0010871d435e83046" }, { "url": "https://git.kernel.org/stable/c/ecfb47f13b08b02cf28b7b50d4941eefa21954d2" }, { "url": "https://git.kernel.org/stable/c/81aa58cd8495b8c3b527f58ccbe19478d8087f61" }, { "url": "https://git.kernel.org/stable/c/da3da5e1e6f71c21d8e6149d7076d936ef5d4cb9" }, { "url": "https://git.kernel.org/stable/c/a50b796d36719757526ee094c703378895ab5e67" }, { "url": "https://git.kernel.org/stable/c/88b7894a8f8705bf4e7ea90b10229376abf14514" }, { "url": "https://git.kernel.org/stable/c/87c681ab49e99039ff2dd3e71852417381b13878" }, { "url": "https://git.kernel.org/stable/c/22cad8bc1d36547cdae0eef316c47d917ce3147c" } ], "title": "jfs: fix array-index-out-of-bounds in dbFindLeaf", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2023-52799", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-23T17:20:55.514685Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:24:02.467Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:36.041Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/20f9310a18e3e99fc031e036fcbed67105ae1859", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/86df90f3fea7c5591f05c8a0010871d435e83046", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ecfb47f13b08b02cf28b7b50d4941eefa21954d2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/81aa58cd8495b8c3b527f58ccbe19478d8087f61", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/da3da5e1e6f71c21d8e6149d7076d936ef5d4cb9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a50b796d36719757526ee094c703378895ab5e67", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/88b7894a8f8705bf4e7ea90b10229376abf14514", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/87c681ab49e99039ff2dd3e71852417381b13878", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/22cad8bc1d36547cdae0eef316c47d917ce3147c", "tags": [ "x_transferred" ] } ] } ] } }