Executive brief
The Linux kernel's NTFS3 filesystem driver contains a buffer over-read vulnerability in its index handling code. When processing specially crafted NTFS filesystem metadata, the vulnerable code can read data beyond allocated buffer boundaries. An attacker mounting a malicious NTFS filesystem could trigger this bug to leak kernel memory or crash the system.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the ntfs3 filesystem driver's indx_insert_into_buffer function. The root cause is insufficient validation of index buffer structure fields: when the "used" field (__le32) exceeds the "total" field (__le32) in the INDEX_HDR structure, a memmove operation reads beyond the allocated slab buffer. The attack vector requires mounting a crafted NTFS filesystem, no authentication needed. The fix adds a bounds check in hdr_find_e() to validate that the used size does not exceed total size, returning NULL if violated. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Versions with ntfs3 driver support (approximately 5.15 and later, up to and including multiple stable branches)
Timeline
- 2025-12-24: disclosed: Vulnerability advisory published
- 2023-05-11: patched: Fix merged into stable Linux kernel branches
- 2022-12-07: other: Original patch authored by ZhangPeng