CVE-2023-52603: UBSAN: array-index-out-of-bounds in dtSplitRoot
In the Linux kernel, the following vulnerability has been resolved:
UBSAN: array-index-out-of-bounds in dtSplitRoot
Syzkaller reported the following issue:
oop0: detected capacity change from 0 to 32768
UBSAN: array-index-out-of-bounds in fs/jfs/jfsdtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x1b1/0x28e lib/dumpstack.c:106 ubsanepilogue lib/ubsan.c:151 [inline] ubsanhandleoutofbounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfsdtree.c:1971 dtSplitUp fs/jfs/jfsdtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfsdtree.c:863 jfsmkdir+0x757/0xb00 fs/jfs/namei.c:270 vfsmkdir+0x3b3/0x590 fs/namei.c:4013 domkdirat+0x279/0x550 fs/namei.c:4038 dosysmkdirat fs/namei.c:4053 [inline] sesysmkdirat fs/namei.c:4051 [inline] x64sysmkdirat+0x85/0x90 fs/namei.c:4051 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIGRAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK>
The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0.
The patch is tested via syzbot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.0.0-syzkaller-09423-g493ffd6605b2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52603?
CVE-2023-52603 has a severity rating that indicates a potential significant impact on affected Linux kernel versions.
How do I fix CVE-2023-52603?
To fix CVE-2023-52603, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of the Linux kernel are affected by CVE-2023-52603?
CVE-2023-52603 affects the Linux kernel versions from 4.19.307 up to 6.7.4.
What is the nature of the vulnerability in CVE-2023-52603?
CVE-2023-52603 is an array-index-out-of-bounds vulnerability in the Linux kernel's dtSplitRoot function.
Is there a workaround for CVE-2023-52603?
No official workaround is provided for CVE-2023-52603; applying the available patches is recommended.