CVE-2023-52599: 
Linux Kernel vulnerability analysis and mitigation

An array-index-out-of-bounds vulnerability was discovered in the diNewExt function within the Linux kernel's JFS (Journaled File System) implementation. The vulnerability was assigned CVE-2023-52599 and was discovered by a syzkaller report. The issue affects multiple versions of the Linux kernel up to versions 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, and 6.7.4 (NVD).

The vulnerability occurs in the fs/jfs/jfs_imap.c file when the agstart value is too large, causing an agno overflow. This results in an array-index-out-of-bounds condition in the diNewExt function at line 2360, where the index -878706688 is out of range for type 'struct iagctl[128]'. The issue was discovered during kernel testing with syzkaller (Kernel Patch).

The vulnerability could result in a system crash, leading to a denial of service condition. Red Hat has assessed this with a CVSS v3.1 base score of 5.5, indicating moderate severity with potential availability impact (Red Hat).

The vulnerability requires local access and low privileges to exploit. The attack complexity is rated as low, but user interaction is not required for exploitation (Red Hat).

The vulnerability has been fixed by adding validation checks for the agno value after it is obtained. If the value is invalid (agno >= MAXAG || agno < 0), the process exits with an -EIO error. The fix has been implemented in various kernel versions through patches (Kernel Patch).