Executive brief
The Linux kernel's NTFS3 filesystem driver contains a memory buffer overflow vulnerability when handling NTFS log pages on systems with 64K page sizes. An attacker who can mount a specially crafted NTFS filesystem image could trigger an out-of-bounds memory write, potentially leading to denial of service or code execution.
Technical details
This is a heap buffer overflow (CWE-122) in the NTFS3 filesystem code, specifically in the read_log_page() function within fs/ntfs3/fslog.c. The vulnerability occurs when PAGE_SIZE is 64K: the buffer is initially allocated at the default log page size (4K), but subsequent memcpy operations attempt to write data larger than 4K (up to 64K or beyond), causing a slab-out-of-bounds condition detected by KASAN. The root cause is that read_log_page() allocated a fixed 4K buffer but attempted to read variable-sized pages determined by the filesystem being mounted. No authentication is required; the vulnerability triggers during filesystem mount operations (ntfs_fill_super). The fix ensures buffer sizes match the actual page size being read.
Affected products
- Linux Linux kernel 5.10 through 5.19 and 6.0 through 6.8 (vulnerable versions prior to patch commit ecfbd57cf9c5ca225184ae266ce44ae473792132)
Timeline
- 2025-12-30: disclosed: CVE-2022-50869 published on NVD
- 2023-01-04: patched: Fix merged into stable kernel trees via commit ecfbd57cf9c5ca225184ae266ce44ae473792132