CVE-2023-53988

Vulnerability

The ntfs3 filesystem driver in the Linux kernel contains a slab-out-of-bounds read vulnerability in the hdr_delete_de() function (fs/ntfs3/index.c). The bug occurs when processing a corrupted or malicious NTFS image that provides invalid metadata in the index header [1].

Exploitation

An attacker with the ability to mount a specially crafted NTFS filesystem can trigger the vulnerability by performing file operations such as unlink or rename (e.g., ntfs_unlink_inode, ntfs_rename). No special privileges are required beyond the ability to mount a filesystem [1].

Impact

The out-of-bounds read, reported by KASAN, can read up to 16842960 bytes beyond allocated memory, leading to a kernel panic and denial of service [1].

Mitigation

Patches have been applied to the stable Linux kernel branches [1][2]. Users should update their kernels to include the fix, which adds validation of the index header before use.