mbox series

[SRU,M/J/F,0/1] CVE-2023-52600

Message ID 20240322165710.13020-1-bethany.jamison@canonical.com
Headers show
Series CVE-2023-52600 | expand

Message

Bethany Jamison March 22, 2024, 4:57 p.m. UTC 
[Impact]

 In the Linux kernel, the following vulnerability has been resolved:

 jfs: fix uaf in jfs_evict_inode

 When the execution of diMount(ipimap) fails, the object ipimap that has
 been
 released may be accessed in diFreeSpecial(). Asynchronous ipimap release
 occurs
 when rcu_core() calls jfs_free_node().

 Therefore, when diMount(ipimap) fails, sbi->ipimap should not be
 initialized as
 ipimap.

[Fix]

Mantic: Clean cherry-pick
Jammy: Mantic patch applied cleanly
Focal: Mantic patch applied cleanly
Bionic: sent to esm ML
Xenial: sent to esm ML
Trusty: not going to be fixed by us

[Test Case]

Compile and boot tested.

[Where problems could occur]

This affects jfs, issues could occur when initializing the
inode map to keep track of files and directories within the 
filesystem.

Edward Adam Davis (1):
  jfs: fix uaf in jfs_evict_inode

 fs/jfs/jfs_mount.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Bethany Jamison March 22, 2024, 4:58 p.m. UTC | #1 
... forgot to update version number with submission -- will update and 
send again

On 3/22/24 11:57 AM, Bethany Jamison wrote:
> [Impact]
>
>   In the Linux kernel, the following vulnerability has been resolved:
>
>   jfs: fix uaf in jfs_evict_inode
>
>   When the execution of diMount(ipimap) fails, the object ipimap that has
>   been
>   released may be accessed in diFreeSpecial(). Asynchronous ipimap release
>   occurs
>   when rcu_core() calls jfs_free_node().
>
>   Therefore, when diMount(ipimap) fails, sbi->ipimap should not be
>   initialized as
>   ipimap.
>
> [Fix]
>
> Mantic: Clean cherry-pick
> Jammy: Mantic patch applied cleanly
> Focal: Mantic patch applied cleanly
> Bionic: sent to esm ML
> Xenial: sent to esm ML
> Trusty: not going to be fixed by us
>
> [Test Case]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> This affects jfs, issues could occur when initializing the
> inode map to keep track of files and directories within the
> filesystem.
>
> Edward Adam Davis (1):
>    jfs: fix uaf in jfs_evict_inode
>
>   fs/jfs/jfs_mount.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>