Information disclosure in Linux kernel jfs

1) Out-of-bounds read

EUVDB-ID: #VU89254

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52602

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the dtSearch() function in fs/jfs/jfs_dtree.c. A local user can trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/ce8bc22e948634a5c0a3fa58a179177d0e3f3950
http://git.kernel.org/stable/c/1b9d6828589d57f94a23fb1c46112cda39d7efdb
http://git.kernel.org/stable/c/1c40ca3d39d769931b28295b3145c25f1decf5a6
http://git.kernel.org/stable/c/6c6a96c3d74df185ee344977d46944d6f33bb4dd
http://git.kernel.org/stable/c/cab0c265ba182fd266c2aa3c69d7e40640a7f612
http://git.kernel.org/stable/c/7110650b85dd2f1cee819acd1345a9013a1a62f7
http://git.kernel.org/stable/c/bff9d4078a232c01e42e9377d005fb2f4d31a472
http://git.kernel.org/stable/c/fa5492ee89463a7590a1449358002ff7ef63529f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.