jfs: check if leafidx greater than num leaves per dmap tree

Summary

In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf. Shaggy: Modified sanity check to apply to control pages as well as leaf pages.

Timeline

1. Oct 21, 2024, 6:01 PM UTCCVE published
2. Oct 22, 2024, 1:42 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 15, 2026, 12:54 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in d76b9a4c283c7535ae7c7c9b14984e75402951e1; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 35b91f15f44ce3c01eba058ccb864bb04743e792; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 2451e5917c56be45d4add786e2a059dd9c2c37c4; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 25d2a3ff02f22e215ce53355619df10cc5faa7ab; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 058aa89b3318be3d66a103ba7c68d717561e1dc6; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 7fff9a9f866e99931cf6fa260288e55d01626582; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in cb0eb10558802764f07de1dc439c4609e27cb4f0; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 4a7bf6a01fb441009a6698179a739957efd88e38; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in d64ff0d2306713ff084d4b09f84ed1a8c75ecc32

• Linux Linux

  2.6.12

• KernelLinux

  From 2.6.12 · fixed in 4.19.323; From 4.20.0 · fixed in 5.4.285; From 5.5.0 · fixed in 5.10.227; From 5.11.0 · fixed in 5.15.168; From 5.16.0 · fixed in 6.1.113; From 6.2.0 · fixed in 6.6.55; From 6.7.0 · fixed in 6.10.14; From 6.11.0 · fixed in 6.11.3

References 9