CVE-2023-53732

Vulnerability

In the ntfs3 filesystem driver, when creating a new inode, if memory allocation fails in the mi_init function (called via mi_format_new), the mi->mrec pointer is set to NULL. In the error path of inode creation, ni_write_inode is called and dereferences mi->mrec without a NULL check, causing a NULL pointer dereference [1].

Exploitation

The vulnerability is triggered by a local user or process that can trigger inode creation on an ntfs3 filesystem, such as mounting a crafted NTFS volume and performing operations that cause allocation failure. No special privileges beyond the ability to mount and access the filesystem are required. The attack surface is local, requiring physical or remote access to the system with the ability to mount a malicious NTFS image.

Impact

A successful exploit results in a kernel NULL pointer dereference, leading to a system crash (denial of service). The vulnerability does not appear to allow privilege escalation or code execution, as it is a NULL dereference that typically causes an oops.

Mitigation

The fix adds a NULL check in ni_write_inode to prevent the dereference. The patch was applied to the Linux kernel mainline and backported to stable branches [1][2][3][4]. Users should update their kernel to a version containing the fix.