CVE-2022-50567

A flaw was discovered in the JFS (Journaled File System) implementation in the Linux kernel: when mounting an AG (allocation group), the field db_agl2size in the AG bitmap (bmp) can exceed its expected upper bound, leading to a shift operation beyond the valid bit‐width and causing a shift-out-of-bounds condition in dbAllocAG(). A local user or process with privileges to mount/manage a JFS filesystem could trigger this condition, which could lead to filesystem corruption or unexpected kernel behaviour (impacting integrity and availability).

A shift-out-of-bounds vulnerability was found in the Linux kernel's JFS (Journaled File System) implementation. The db_agl2size field of the allocation-group (AG) bitmap is not validated at mount time in dbMount(); a value exceeding its expected upper bound (L2MAXL2SIZE - L2MAXAG) is later used as a shift operand in dbAllocAG(), triggering an undefined shift-out-of-bounds condition. A local user with the ability to mount a specially crafted JFS filesystem could use this flaw to cause a kernel crash or filesystem corruption, impacting system availability and data integrity. Red Hat assessed the impact of this flaw as Moderate, lower than the upstream severity, because exploitation requires local access and the ability to mount an attacker-controlled filesystem. The vulnerable code is not present in the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels (including kernel-rt) or in Red Hat In-Vehicle OS 1.0 and 1.1 as shipped, so those products are not affected; the remaining Red Hat Enterprise Linux 6 entry is out of support scope (OOSS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.