CVE-2023-52810

In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Add check for negative db_l2nbperpage

l2nbperpage is log2(number of blks per page), and the minimum legal value should be 0, not negative.

In the case of l2nbperpage being negative, an error will occur when subsequently used as shift exponent.

Syzbot reported this bug:

UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12 shift exponent -16777216 is negative

Weakness

An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

Affected Software

Extended Description

Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.

Potential Mitigations

References

• https://git.kernel.org/stable/c/0cb567e727339a192f9fd0db00781d73a91d15a6
• https://git.kernel.org/stable/c/1a7c53fdea1d189087544d9a606d249e93c4934b
• https://git.kernel.org/stable/c/491085258185ffc4fb91555b0dba895fe7656a45
• https://git.kernel.org/stable/c/524b4f203afcf87accfe387e846f33f916f0c907
• https://git.kernel.org/stable/c/525b861a008143048535011f3816d407940f4bfa
• https://git.kernel.org/stable/c/5f148b16972e5f4592629b244d5109b15135f53f
• https://git.kernel.org/stable/c/8f2964df6bfce9d92d81ca552010b8677af8d9dc
• https://git.kernel.org/stable/c/a81a56b4cbe3142cc99f6b98e8f9b3a631c768e1
• https://git.kernel.org/stable/c/cc61fcf7d1c99f148fe8ddfb5c6ed0bb75861f01
• https://git.kernel.org/stable/c/0cb567e727339a192f9fd0db00781d73a91d15a6
• https://git.kernel.org/stable/c/1a7c53fdea1d189087544d9a606d249e93c4934b
• https://git.kernel.org/stable/c/491085258185ffc4fb91555b0dba895fe7656a45
• https://git.kernel.org/stable/c/524b4f203afcf87accfe387e846f33f916f0c907
• https://git.kernel.org/stable/c/525b861a008143048535011f3816d407940f4bfa
• https://git.kernel.org/stable/c/5f148b16972e5f4592629b244d5109b15135f53f
• https://git.kernel.org/stable/c/8f2964df6bfce9d92d81ca552010b8677af8d9dc
• https://git.kernel.org/stable/c/a81a56b4cbe3142cc99f6b98e8f9b3a631c768e1
• https://git.kernel.org/stable/c/cc61fcf7d1c99f148fe8ddfb5c6ed0bb75861f01