Linux Kernel Shift-Out-Of-Bounds Vulnerability in JFS File System

A shift-out-of-bounds vulnerability has been identified in the Linux kernel's JFS file system. This issue arises from a missing validation of the 'db_agl2size' field, which can exceed 64 and cause an out-of-bounds shift in the 'dbAllocAG' function. The vulnerability has been addressed by adding a check for 'db_agl2size' in the 'dbMount' function, as this field is utilized in several subsequent functions. The upper limit for 'db_agl2size' is 'L2MAXL2SIZE' minus 'L2MAXAG'.

Impact

Exploitation of this vulnerability leads to a shift-out-of-bounds error, which can cause a crash in the affected system.

Reproduction

The vulnerability can be reproduced by manipulating the 'db_agl2size' field to exceed 64, which triggers the out-of-bounds shift during the allocation process in the JFS file system.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the Linux Kernel Git Repository under the stable branch.