PT-2025-40192 · Linux+2 · Linux Kernel+2
Published
2023-06-22
·
Updated
2025-11-19
·
CVE-2023-53485
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.4.0-rc6-syzkaller-00037-gb6dad5178cea
Description
The Linux kernel contains a flaw within the JFS filesystem implementation. Specifically, an out-of-bounds array access can occur in the
dbAllocDmapLev function when handling negative leafidx values. This issue was identified through testing with Syzkaller, a coverage-guided fuzzer. The vulnerability arises when attempting to access dp->tree.stree[leafidx + LEAFIND] with a negative leafidx. A patch has been implemented to prevent this by adding a check to ensure leafidx is not negative, returning an I/O error if it is.Recommendations
Update the Linux kernel to version 6.4.0-rc6-syzkaller-00037-gb6dad5178cea or a later version that includes the fix.
Exploit
Fix
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse