504 lines
24 KiB
JSON
504 lines
24 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-52602",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-03-02T21:55:42.573Z",
|
||
"datePublished": "2024-03-06T06:45:29.227Z",
|
||
"dateUpdated": "2026-08-05T09:10:36.782Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T09:10:36.782Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix slab-out-of-bounds Read in dtSearch\n\nCurrently while searching for current page in the sorted entry table\nof the page there is a out of bound access. Added a bound check to fix\nthe error.\n\nDave:\nSet return code to -EIO"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is reached only after a crafted JFS block/loop image is mounted locally and a directory lookup runs (openat/lookup → jfs_lookup → dtSearch); fs/jfs has no network or adjacent-protocol entry path.\nAC:L - The attacker fully controls on-disk dtree stbl slot indices (s8 values, including freelist sentinel -1), so a negative stbl entry deterministically drives &p->slot[stbl[index]] out of bounds on ordinary path lookup with no race or attacker-uncontrollable state.\nPR:L - JFS lacks FS_USERNS_MOUNT so mount(2) needs CAP_SYS_ADMIN, but as with sibling JFS crafted-image CVEs an unprivileged local session user can attach the malicious image via udisks2/polkit/automount on desktops, kiosks, and shared workstations, then trigger dtSearch with ordinary opens.\nUI:N - The attacker supplies the image, causes it to be mounted (including via automount/udisks on their own session), and drives lookups themselves; no separate victim action is required at exploitation time.\nS:U - The slab out-of-bounds read and any resulting kernel memory disclosure or crash remain within the host kernel’s security authority and do not cross a VM, IOMMU, or other boundary.\nC:H - A negative attacker-chosen stbl index makes ciCompare/dtCompare and getChild read ldtentry/idtentry fields from adjacent slab/metapage memory at a large offset (up to 128 slots × 32 bytes), an unbounded OOB read that can be leveraged for high-impact disclosure.\nI:H - OOB-derived slot contents are consumed as directory entry names, inumbers, and child PXDs (getChild uses &p->slot[stbl[index]] to pick the next dtree block), so corrupted values steer subsequent inode resolution and directory-mutation paths into kernel/metadata corruption; choose High under uncertainty consistent with sibling JFS scores.\nA:H - KASAN reports a slab-out-of-bounds read in dtSearch (syzkaller/kernel test robot), and reading far before the dtroot/dtpage slot array can fault on unmapped memory and oops/panic the kernel."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/jfs/jfs_dtree.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "ce8bc22e948634a5c0a3fa58a179177d0e3f3950",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "1b9d6828589d57f94a23fb1c46112cda39d7efdb",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "1c40ca3d39d769931b28295b3145c25f1decf5a6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "6c6a96c3d74df185ee344977d46944d6f33bb4dd",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "cab0c265ba182fd266c2aa3c69d7e40640a7f612",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "7110650b85dd2f1cee819acd1345a9013a1a62f7",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "bff9d4078a232c01e42e9377d005fb2f4d31a472",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
|
||
"lessThan": "fa5492ee89463a7590a1449358002ff7ef63529f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/jfs/jfs_dtree.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2.6.12",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "2.6.12",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.307",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.269",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.210",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.149",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.77",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.16",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.7.4",
|
||
"lessThanOrEqual": "6.7.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.8",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "4.19.307"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "5.4.269"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "5.10.210"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "5.15.149"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "6.1.77"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "6.6.16"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "6.7.4"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.12",
|
||
"versionEndExcluding": "6.8"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ce8bc22e948634a5c0a3fa58a179177d0e3f3950"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1b9d6828589d57f94a23fb1c46112cda39d7efdb"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1c40ca3d39d769931b28295b3145c25f1decf5a6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6c6a96c3d74df185ee344977d46944d6f33bb4dd"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cab0c265ba182fd266c2aa3c69d7e40640a7f612"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/7110650b85dd2f1cee819acd1345a9013a1a62f7"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/bff9d4078a232c01e42e9377d005fb2f4d31a472"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fa5492ee89463a7590a1449358002ff7ef63529f"
|
||
}
|
||
],
|
||
"title": "jfs: fix slab-out-of-bounds Read in dtSearch",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"cweId": "CWE-400",
|
||
"lang": "en",
|
||
"description": "CWE-400 Uncontrolled Resource Consumption"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "linux",
|
||
"product": "linux_kernel",
|
||
"cpes": [
|
||
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"versions": [
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "ce8bc22e9486",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "1b9d6828589d",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "1c40ca3d39d7",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "6c6a96c3d74d",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "cab0c265ba18",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "7110650b85dd",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "bff9d4078a23",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "1da177e4c3f4",
|
||
"status": "affected",
|
||
"lessThan": "fa5492ee8946",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "4.19.307",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "4.20",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "5.4.269",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "5.5",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "5.10.210",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "5.11",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "5.15.149",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "5.16",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "6.1.77",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "6.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "6.6.16",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "6.7",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "6.7.4",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "6.8",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "6.8",
|
||
"status": "unaffected",
|
||
"lessThanOrEqual": "*",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.8,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"integrityImpact": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-07-23T15:55:18.699623Z",
|
||
"id": "CVE-2023-52602",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-04-16T15:55:56.866Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T23:03:21.268Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ce8bc22e948634a5c0a3fa58a179177d0e3f3950",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1b9d6828589d57f94a23fb1c46112cda39d7efdb",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1c40ca3d39d769931b28295b3145c25f1decf5a6",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6c6a96c3d74df185ee344977d46944d6f33bb4dd",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cab0c265ba182fd266c2aa3c69d7e40640a7f612",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/7110650b85dd2f1cee819acd1345a9013a1a62f7",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/bff9d4078a232c01e42e9377d005fb2f4d31a472",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fa5492ee89463a7590a1449358002ff7ef63529f",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"dataVersion": "5.2"
|
||
} |