CVE-2023-53485

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.0-rc6-syzkaller-00037-gb6dad5178cea

Description The Linux kernel contains a flaw within the JFS filesystem implementation. Specifically, an out-of-bounds array access can occur in the dbAllocDmapLev function when handling negative leafidx values. This issue was identified through testing with Syzkaller, a coverage-guided fuzzer. The vulnerability arises when attempting to access dp->tree.stree[leafidx + LEAFIND] with a negative leafidx. A patch has been implemented to prevent this by adding a check to ensure leafidx is not negative, returning an I/O error if it is.

Recommendations Update the Linux kernel to version 6.4.0-rc6-syzkaller-00037-gb6dad5178cea or a later version that includes the fix.