CVE-2023-54272

Vulnerability

In the Linux kernel's ntfs3 filesystem driver, a null-pointer dereference vulnerability exists in the ni_clear() function. The issue arises because ni->mi.mrec can be NULL when ni_clear() is called from the inode eviction path (ntfs_evict_inode). While a previous commit (c1006bd13146) added a NULL check for ni->mi.mrec in ni_write_inode(), the same dereference occurs in ni_clear() without a corresponding check [1][2].

Exploitation

An attacker would need local access to the system and the ability to trigger inode eviction on a mounted NTFS filesystem. The vulnerability is triggered during normal filesystem operations when the kernel evicts an NTFS inode, leading to a call to ni_clear() with a potentially NULL ni->mi.mrec pointer. No special privileges beyond the ability to interact with the filesystem are required.

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). The vulnerability does not appear to allow privilege escalation or arbitrary code execution based on the available information.

Mitigation

The fix adds a NULL check for ni->mi.mrec in ni_clear(), preventing the dereference. The patch has been applied to the stable kernel branches as commits 39c631200957 and ec275bf9693d [1][2]. Users should update their kernel to include these patches.