{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56597","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-27T14:03:06.010Z","datePublished":"2024-12-27T14:51:04.184Z","dateUpdated":"2026-08-05T11:45:16.339Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:45:16.339Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix shift-out-of-bounds in dbSplit\n\nWhen dmt_budmin is less than zero, it causes errors\nin the later stages. Added a check to return an error beforehand\nin dbAllocCtl itself."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The poisoned `dmt_budmin` byte only reaches `dbSplit()` after a local mount of an attacker-supplied JFS image or block device, via loop mount or removable media; there is no network or adjacent-network path into the JFS block allocator.\nAC:L - `budmin` is a single s8 field in the on-disk dmap page that the attacker sets directly in the crafted image, and any subsequent block allocation deterministically drives `dbAllocCtl() → dbAllocDmapLev() → dbAllocDmap() → dbAllocBits() → dbSplit()`; no race, timing, or memory-layout condition outside the attacker's control is involved.\nPR:L - An unprivileged local user gets an attacker-crafted image mounted through loop devices or desktop/kiosk automounters (udisks2, systemd) that mount removable media on their behalf, and this is how the repo scores equivalent on-disk validation bugs (CVE-2025-22079, CVE-2024-56692, CVE-2024-58094).\nUI:N - In the automount/loop scenario the attacker performs both the mount and the subsequent write that triggers block allocation, so no separate victim action is required.\nS:U - The corrupted dmap summary tree, the out-of-range indices, and any resulting crash all remain inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The undefined `1 << (cursz - budmin)` shift yields out-of-range buddy indices that are used to index the dmap summary tree, and on the paired free path `dbJoin()` dereferences `leaf[leafno ^ budsz]` with no bounds check at all, giving out-of-bounds reads of kernel memory adjacent to the metapage.\nI:H - Bogus `budsz` values cause `dbAdjTree()` to write attacker-influenced leaf values into wrong slots of the block allocation map, so the same disk blocks can be handed out to both file data and filesystem metadata — arbitrary corruption of on-disk state — and because the shift is undefined behaviour the computed index is not reliably contained.\nA:H - The shift-out-of-bounds is a UBSAN report that panics under `CONFIG_UBSAN_TRAP` or `panic_on_warn`, the `WARN_ON_ONCE` in `dbAdjTree()` is likewise fatal with `panic_on_warn`, and the corrupted allocation state drives `jfs_error()`/filesystem shutdown — all kernel-level denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"df7c76636952670b31bd6c12b3aed3c502122273","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6676034aa753aa448beb30dbd75630927ba7cd96","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"51a203470f502a64a3da8dcea51c4748e8267a6c","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c56245baf3fd1f79145dd7408e3ead034b74255c","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"52756a57e978e2706543a254f88f266cc6702f36","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.4.287","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.231","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.174","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.120","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.66","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.5","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.4.287"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.231"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.174"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e"},{"url":"https://git.kernel.org/stable/c/df7c76636952670b31bd6c12b3aed3c502122273"},{"url":"https://git.kernel.org/stable/c/6676034aa753aa448beb30dbd75630927ba7cd96"},{"url":"https://git.kernel.org/stable/c/51a203470f502a64a3da8dcea51c4748e8267a6c"},{"url":"https://git.kernel.org/stable/c/c56245baf3fd1f79145dd7408e3ead034b74255c"},{"url":"https://git.kernel.org/stable/c/52756a57e978e2706543a254f88f266cc6702f36"},{"url":"https://git.kernel.org/stable/c/a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d"}],"title":"jfs: fix shift-out-of-bounds in dbSplit","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:50:30.604Z"}}]}}