Executive brief
A vulnerability exists in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. This issue impacts the stability and security of systems that mount NTFS partitions.
Technical details
A vulnerability was identified in the fs/ntfs3 component of the Linux kernel. The mi_enum_attr function in record.c lacked a sufficient check for the attribute allocation size (alloc_size) against the actual volume size. A local user with the ability to mount or interact with a specially crafted NTFS filesystem could trigger this flaw. The fix introduces a 'rough' validation check to ensure the requested allocation size does not exceed the volume size, preventing potential out-of-bounds conditions or resource exhaustion. Patches have been merged into multiple stable kernel branches including 6.1.y, 6.6.y, and 6.11.y.
Affected products
- Linux Linux Kernel up to 6.6.60, 6.7 to 6.11.7, 6.12-rc1, 6.12-rc2
Timeline
- 2024-08-19: other: Patch authored
- 2024-11-09: disclosed: CVE published
- 2024-11-08: patched: Patch committed to stable trees
References
- https://git.kernel.org/stable/c/2fcae4c2014a40c8ae0fc3d8cca3ba9e168308de
- https://git.kernel.org/stable/c/c4a8ba334262e9a5c158d618a4820e1b9c12495c
- https://git.kernel.org/stable/c/e91fbb21f248bdd8140f343dac32b77b9bc10fec
- https://git.kernel.org/stable/c/effac690913af9a6c3d6cd967281a34e47ed3e4c
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html