CVE-2023-52804

fs/jfs: Add validity check for db_maxag and db_agpref

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Add validity check for db_maxag and db_agpref

Both db_maxag and db_agpref are used as the index of the db_agfree array, but there is currently no validity check for db_maxag and db_agpref, which can lead to errors.

The following is related bug reported by Syzbot:

UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20 index 7936 is out of range for type 'atomic_t[128]'

Add checking that the values of db_maxag and db_agpref are valid indexes for the db_agfree array.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a0649e2dd4a3595b5595a29d0064d047c2fae2fbAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ce15b0f1a431168f07b1cc6c9f71206a2db5c809Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 32bd8f1cbcf8b663e29dd1f908ba3a129541a11bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c6c8863fb3f57700ab583d875adda04caaf2278aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f74d336990f37703a8eee77153463d65b67f70eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5013f8269887642cca784adc8db9b5f0b771533fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dca403bb035a565bb98ecc1dda5d30f676feda40Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2323de34a3ae61a9f9b544c18583f71cea86721fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64933ab7b04881c6c18b21ff206c12278341c72eAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.14.331 through 4.14.Not affected 4.19.300 through 4.19.Not affected 5.4.262 through 5.4.Not affected 5.10.202 through 5.10.Not affected 5.15.140 through 5.15.Not affected 6.1.64 through 6.1.Not affected 6.5.13 through 6.5.Not affected 6.6.3 through 6.6.Not affected 6.7 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a0649e2dd4a3595b5595a29d0064d047c2fae2fbAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ce15b0f1a431168f07b1cc6c9f71206a2db5c809Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 32bd8f1cbcf8b663e29dd1f908ba3a129541a11bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c6c8863fb3f57700ab583d875adda04caaf2278aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f74d336990f37703a8eee77153463d65b67f70eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5013f8269887642cca784adc8db9b5f0b771533fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dca403bb035a565bb98ecc1dda5d30f676feda40Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2323de34a3ae61a9f9b544c18583f71cea86721fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64933ab7b04881c6c18b21ff206c12278341c72eAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.14.331 through 4.14.*Not affected
4.19.300 through 4.19.*Not affected
5.4.262 through 5.4.*Not affected
5.10.202 through 5.10.*Not affected
5.15.140 through 5.15.*Not affected
6.1.64 through 6.1.*Not affected
6.5.13 through 6.5.*Not affected
6.6.3 through 6.6.*Not affected
6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.