Bug 2405732 (CVE-2022-50567)

Summary: CVE-2022-50567 kernel: fs: jfs: fix shift-out-of-bounds in dbAllocAG
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was discovered in the JFS (Journaled File System) implementation in the Linux kernel: when mounting an AG (allocation group), the field db_agl2size in the AG bitmap (bmp) can exceed its expected upper bound, leading to a shift operation beyond the valid bit‐width and causing a shift-out-of-bounds condition in dbAllocAG(). A local user or process with privileges to mount/manage a JFS filesystem could trigger this condition, which could lead to filesystem corruption or unexpected kernel behaviour (impacting integrity and availability).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-22 14:02:55 UTC 
In the Linux kernel, the following vulnerability has been resolved:

fs: jfs: fix shift-out-of-bounds in dbAllocAG

Syzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The
underlying bug is the missing check of bmp->db_agl2size. The field can
be greater than 64 and trigger the shift-out-of-bounds.

Fix this bug by adding a check of bmp->db_agl2size in dbMount since this
field is used in many following functions. The upper bound for this
field is L2MAXL2SIZE - L2MAXAG, thanks for the help of Dave Kleikamp.
Note that, for maintenance, I reorganized error handling code of dbMount.
Comment 1 Jon Moroney 2025-10-22 17:47:02 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025102207-CVE-2022-50567-17f3@gregkh/T