Vulnerability-Lookup

GHSA-362H-J6WW-X5F8

Vulnerability from github – Published: 2025-07-04 15:31 – Updated: 2025-12-18 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds read in add_missing_indices

stbl is s8 but it must contain offsets into slot which can go from 0 to 127.

Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38204"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-04T14:15:28Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error.",
  "id": "GHSA-362h-j6ww-x5f8",
  "modified": "2025-12-18T21:31:33Z",
  "published": "2025-07-04T15:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38204"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38204 (GCVE-0-2025-38204)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00

Title

jfs: fix array-index-out-of-bounds read in add_missing_indices

Summary

In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/81af4b34fd72d390d…
https://git.kernel.org/stable/c/bfa4655d28f338e68…
https://git.kernel.org/stable/c/44618bee303bed151…
https://git.kernel.org/stable/c/c8399564a58fb6ea2…
https://git.kernel.org/stable/c/5dff41a86377563f7…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 81af4b34fd72d390d7f237c6a545cc6d09707956 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfa4655d28f338e68d345aed80d19be7999bbce2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 44618bee303bed151ef3a525ff79fbd7689593b5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c8399564a58fb6ea2ff21a6fd278417943cb51a5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5dff41a86377563f7a2b968aae00d25b4ceb37c9 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.4.295 , ≤ 5.4.* (semver) Unaffected: 5.10.239 , ≤ 5.10.* (semver) Unaffected: 5.15.186 , ≤ 5.15.* (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:26.756Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/jfs_dtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81af4b34fd72d390d7f237c6a545cc6d09707956",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bfa4655d28f338e68d345aed80d19be7999bbce2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "44618bee303bed151ef3a525ff79fbd7689593b5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c8399564a58fb6ea2ff21a6fd278417943cb51a5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5dff41a86377563f7a2b968aae00d25b4ceb37c9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/jfs_dtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack requires a crafted JFS image to be presented to and mounted on the local system (loop device, or removable media auto-mounted by udisks2/autofs on a kiosk or shared workstation), after which the trigger is an ordinary local getdents64() syscall on a directory. There is no network or remote-peer input path into jfs_readdir()/add_missing_indices().\nAC:L - Every controlling value \u2014 the negative stbl[] entries, the starting slot in the dir_table entry that makes readdir skip them, the out-of-range d-\u003eindex that sets fix_page, and next_index \u2014 is read verbatim from the attacker\u0027s image, so the out-of-bounds access is fully deterministic with no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker only has to author the filesystem image and needs no account or privilege on the target; once mounted, the vulnerable path is reached by an unprivileged readdir with no capable() or permission check anywhere between the syscall and add_missing_indices().\nUI:R - A user or an automounter on the victim system must mount the malicious JFS image read-write before the corrupted dtree page is ever ingested; on a desktop the file manager then issues the getdents that trips the bug without further action.\nS:U - The out-of-bounds read, the out-of-bounds write, and the corrupted journal records are all confined to the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The negative index reads kernel memory up to 4064 bytes before the metapage folio, and because lv-\u003eoffset is u8 the same value makes lmWriteRecord() memcpy 32 bytes from up to 4064 bytes past the metapage into the journal, persisting kernel heap contents onto storage the attacker supplied and can read back \u2014 far beyond a bounded few-byte read.\nI:H - When the out-of-bounds-read d-\u003eindex fails the (2 \u003c= index \u003c next_index) test \u2014 which arbitrary adjacent heap data almost always does \u2014 the code performs a 4-byte out-of-bounds write of add_index()\u0027s return value at an attacker-chosen 32-byte-aligned offset among 128 possible slots before the metapage, giving a groomable heap corruption primitive in addition to the bogus linelock that corrupts the on-disk journal.\nA:H - The wild read and write reach adjacent page-cache folios and other kernel allocations, producing a KASAN report/oops or corrupting live kernel structures, and the malformed journal line-vector writes garbage into the log; the attacker can repeat the readdir arbitrarily, so a kernel panic is readily achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:20.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9"
        }
      ],
      "title": "jfs: fix array-index-out-of-bounds read in add_missing_indices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38204",
    "datePublished": "2025-07-04T13:37:24.606Z",
    "dateReserved": "2025-04-16T04:51:23.994Z",
    "dateUpdated": "2026-08-05T12:00:20.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-362H-J6WW-X5F8

CVE-2025-38204 (GCVE-0-2025-38204)

Tags

Sightings

Nomenclature

Related by attack behaviour