CVE-2023-54077

In the Linux kernel's ntfs3 filesystem driver, a memory leak occurs in the ntfs_read_mft() function during failure handling. When processing attributes, the ATTR_ROOT label sets is_root = true but does not consistently set ni->ni_flags |= NI_FLAG_DIR. If a subsequent attribute at ATTR_ALLOC allocates ni->dir.alloc_run, the cleanup function ni_clear() frees the wrong structure because it checks NI_FLAG_DIR to decide which run to free, causing the allocated ni->dir.alloc_run to be leaked [1][2][3].

Exploitation

The vulnerability can be triggered by mounting a specially crafted NTFS filesystem that causes ntfs_read_mft() to fail after setting is_root but before NI_FLAG_DIR is set, and then allocates ni->dir.alloc_run at ATTR_ALLOC. An attacker with the ability to mount a malicious NTFS volume (e.g., via a USB drive or network filesystem) can exploit this. No authentication is required beyond local access to mount the filesystem.

Impact

A successful exploitation leads to a kernel memory leak, which can exhaust system memory over time, potentially causing a denial of service (DoS). The leak was reported via kmemleak showing an unreferenced object of size 64 bytes [1].

Mitigation

The fix is to always set is_root and NI_FLAG_DIR together at ATTR_ROOT, ensuring consistent state. Patches have been applied to the Linux kernel stable branches [1][2][3]. Users should update their kernels to include the fix. No workaround is available other than avoiding untrusted NTFS mounts.