Executive brief
The Linux kernel's NTFS3 filesystem driver improperly validates buffer lengths when reading NTFS directory index information, allowing a malicious or corrupted NTFS image to trigger out-of-bounds memory reads. An attacker with control over a crafted NTFS disk image can cause a kernel crash or potentially leak sensitive kernel memory when the filesystem is mounted or accessed.
Technical details
The vulnerability exists in the NTFS3 filesystem driver's indx_read function, which parses NTFS index buffers used during directory operations. The root cause is insufficient validation of the returned index buffer length before use in subsequent operations like hdr_find_e, leading to slab-out-of-bounds reads. The attack vector requires either a malicious NTFS disk image or filesystem corruption; a local or adjacent attacker can exploit this by mounting or accessing a crafted filesystem. The vulnerability allows reading 2+ bytes beyond allocated memory boundaries, potentially exposing kernel data and causing denial of service via crash. A fix has been incorporated into the Linux kernel to add proper buffer length sanity checks.
Affected products
- Linux Linux kernel 6.0.0-rc6 and earlier versions with ntfs3 driver
Timeline
- 2025-10-01: disclosed: CVE-2022-50442 published
- patched: Fix added to Linux kernel fs/ntfs3 to validate buffer length in indx_read