In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
indx_find_buffer() recursively descends the B+ tree index with no depth
limit. A crafted NTFS image with circular index node references causes
unbounded recursion, overflowing the kernel stack and panicking the
system.
This is reachable by mounting a malicious NTFS filesystem (e.g. from a
USB drive via desktop automount) and deleting a file whose index entry
triggers the rebalancing fallback path in indx_delete_entry().
Add a depth parameter and bail out with -EINVAL when it reaches the
fnd->nodes array bound, matching the constraint already enforced by
fnd_push() in indx_find().
The related function indx_find() was previously patched for a similar
infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was
missed.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - ntfs3 registers export_operations; on NAS/hybrid servers exporting an NTFS volume via nfsd or ksmbd, a remote client's unlink reaches vfs_unlink→ntfs_unlink_inode→ni_remove_name→indx_delete_entry→indx_find_buffer without any local syscall from the attacker.
AC:L - The attacker fully controls on-disk INDEX_ENTRY VCN pointers and can craft circular B+ tree references so indx_find_buffer() recurses deterministically until stack exhaustion; no race, special heap layout, or other uncontrollable condition is required beyond presenting the image and issuing unlink.
PR:N - Exploitation requires only supplying a malicious NTFS image later mounted by root/udisks2/automount, or write permission on an NFS/SMB-exported NTFS share (including guest/anonymous write); no init-namespace root, CAP_SYS_ADMIN, or other elevated host credentials are needed on the trigger path.
UI:N - Once an administrator has mounted and optionally exported the NTFS volume—or desktop/kiosk automount has attached removable media—the attacker issues unlink directly; no further victim clicks, file opens, or cooperative actions beyond that standing configuration are required.
S:U - Impact is kernel stack overflow and panic within the host kernel's security authority; this is standard local or network filesystem exploitation, not a VM escape, IOMMU bypass, or cross-scope sandbox breakout.
C:H - Unbounded recursion overflows the kernel stack, corrupting stack memory before the guard-page fault; under overestimation guidance, kernel stack corruption is treated as potentially enabling arbitrary kernel memory disclosure or information leakage via control-data overwrite.
I:H - Recursive stack exhaustion corrupts return addresses and adjacent stack frames on the kernel stack, plausibly enabling control-flow hijack or arbitrary kernel modification even though the immediate failure mode is a panic.
A:H - The fix commit and call path confirm unbounded recursion overflows the kernel stack and panics the system; any kernel oops, stack guard fault, or panic from this path scores Availability High.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - ntfs3 registers export_operations; on NAS/hybrid servers exporting an NTFS volume via nfsd or ksmbd, a remote client's unlink reaches vfs_unlink→ntfs_unlink_inode→ni_remove_name→indx_delete_entry→indx_find_buffer without any local syscall from the attacker.
AC:L - The attacker fully controls on-disk INDEX_ENTRY VCN pointers and can craft circular B+ tree references so indx_find_buffer() recurses deterministically until stack exhaustion; no race, special heap layout, or other uncontrollable condition is required beyond presenting the image and issuing unlink.
PR:N - Exploitation requires only supplying a malicious NTFS image later mounted by root/udisks2/automount, or write permission on an NFS/SMB-exported NTFS share (including guest/anonymous write); no init-namespace root, CAP_SYS_ADMIN, or other elevated host credentials are needed on the trigger path.
UI:N - Once an administrator has mounted and optionally exported the NTFS volume—or desktop/kiosk automount has attached removable media—the attacker issues unlink directly; no further victim clicks, file opens, or cooperative actions beyond that standing configuration are required.
S:U - Impact is kernel stack overflow and panic within the host kernel's security authority; this is standard local or network filesystem exploitation, not a VM escape, IOMMU bypass, or cross-scope sandbox breakout.
C:H - Unbounded recursion overflows the kernel stack, corrupting stack memory before the guard-page fault; under overestimation guidance, kernel stack corruption is treated as potentially enabling arbitrary kernel memory disclosure or information leakage via control-data overwrite.
I:H - Recursive stack exhaustion corrupts return addresses and adjacent stack frames on the kernel stack, plausibly enabling control-flow hijack or arbitrary kernel modification even though the immediate failure mode is a panic.
A:H - The fix commit and call path confirm unbounded recursion overflows the kernel stack and panics the system; any kernel oops, stack guard fault, or panic from this path scores Availability High.
CVSS 3.1