CVE-2023-54063

The NTFS3 filesystem driver in the Linux kernel contains a slab-out-of-bounds read vulnerability in the indx_insert_into_buffer function, as reported by syzbot. The root cause is that the INDEX_BUFFER structure within an index node can have an incorrect size indication; specifically, the used field in the INDEX_HDR can be larger than the total field. This discrepancy is not validated before a memmove operation, resulting in a read beyond the allocated buffer when handling crafted filesystem data [1][2].

Exploitation

To trigger the bug, an attacker must be able to mount a malicious NTFS filesystem image or cause the kernel to process corrupted index data. This requires local access to the system and the ability to introduce the mount the filesystem (or have a privileged process do so). No authentication beyond normal user privileges is needed, as filesystem processing occurs in kernel context when initiating a file creation operation via the ntfs_create_inode path [1][2].

Impact

A successful exploit leads to a kernel panic or system crash due to the out-of-bounds read. In more controlled scenarios, it could allow an attacker to read sensitive kernel memory contents, potentially disclosing confidential information. The KASAN report confirms the read size of 17168 bytes beyond the allocated slab [1].

Mitigation

The vulnerability is fixed in patches committed to the Linux kernel stable tree (commit IDs 17048287ac79 and 4bf3b564e27a). Users should apply updates from their distribution or update their kernel to a version containing these fixes. No workaround is known short of patching, as the NTFS3 driver cannot be safely disabled on systems that require NTFS filesystem support [1][2].