Executive brief
The Linux kernel's NTFS3 filesystem driver fails to validate NTFS index header metadata before using it, allowing a corrupted or malicious NTFS filesystem image to trigger out-of-bounds memory reads. An attacker who can provide a crafted NTFS image and trigger file operations on it (such as renaming or unlinking files) can cause the kernel to crash with a panic, resulting in denial of service.
Technical details
This is a slab-out-of-bounds read vulnerability in the NTFS3 filesystem driver, specifically in the hdr_delete_de() function in fs/ntfs3/index.c. The root cause is missing validation of the INDEX_HDR structure before using its metadata fields. When processing a delete entry operation during file rename or unlink, the function calculates a memmove() size based on untrusted header fields without first checking if the header is valid. An attacker-supplied NTFS image with malformed INDEX_HDR metadata causes the function to attempt reading excessively large amounts of memory, triggering a KASAN slab-out-of-bounds error. The attack requires the ability to mount or access a malicious filesystem image. The fix adds a check_index_header() validation call before using the header metadata, preventing the out-of-bounds access.
Affected products
- Linux Linux kernel affected versions from 5.8 onwards (commit 82cae269cfa9); patched in stable branches with commit ab84eee4c7
Timeline
- 2022-12: disclosed: Syzbot report
- 2023-05-11: patched: Fix merged into stable kernel branches
- 2023: other: CVE-2023-53988 assigned