In the Linux kernel, the following vulnerability has been resolved:
ntfs: detect mapping-pairs LCN accumulator overflow
The NTFS mapping-pairs parser accumulates relative LCN deltas in a
signed integer. A corrupted attribute can drive that addition past
the representable range.
One corrupt runlist shape sets the accumulated LCN to S64_MAX and
then adds a delta of 1 in the next mapping-pairs entry.
Signed overflow is undefined and can turn an invalid runlist into a
different set of physical clusters.
Check the LCN addition for overflow before storing the next run.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Legacy NTFS is NFS-exportable (ntfs_export_ops) and commonly served via ksmbd; remote SMB/NFS reads on an exported NTFS mount reach ntfs_mapping_pairs_decompress() through VFS read/iomap and ntfs_map_runlist() without local shell access.
AC:L - An attacker fully controls crafted on-disk mapping pairs offline (e.g., drive LCN to S64_MAX then add +1) and can reliably trigger decompression on mount or the next attribute access that maps the runlist; no races or victim-specific layout are required.
PR:N - Triggering decompression needs only permission to cause server-side parsing of mounted NTFS metadata (e.g., guest/anonymous SMB or permissive NFS read, or unprivileged local open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.
UI:N - After the volume is mounted/exported, exploitation requires only normal remote or local filesystem read/open operations on files whose non-resident attributes carry the poisoned mapping pairs; no additional victim mount dialogs, USB insertion, or other user actions are needed during the attack.
S:U - Impact stays within the kernel/host context (runlist corruption and misdirected block I/O on the mounted volume); it does not cross a VM, container, or IOMMU boundary to another security authority.
C:H - Signed LCN accumulator overflow (undefined behavior) yields attacker-controlled cluster mappings, so subsequent reads can be directed to arbitrary on-volume clusters and disclose other files' data and metadata beyond the accessed object.
I:H - Corrupted LCN values misdirect kernel writeback and allocation I/O to arbitrary physical clusters on the volume, enabling cross-file/metadata tampering and further corruption exploitable for broader integrity compromise.
A:H - Misdirected cluster I/O and corrupt runlists cause mount/read/write failures, can destroy critical structures like $MFT, and repeated remote access can deny service to the host or exported filesystem.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Legacy NTFS is NFS-exportable (ntfs_export_ops) and commonly served via ksmbd; remote SMB/NFS reads on an exported NTFS mount reach ntfs_mapping_pairs_decompress() through VFS read/iomap and ntfs_map_runlist() without local shell access.
AC:L - An attacker fully controls crafted on-disk mapping pairs offline (e.g., drive LCN to S64_MAX then add +1) and can reliably trigger decompression on mount or the next attribute access that maps the runlist; no races or victim-specific layout are required.
PR:N - Triggering decompression needs only permission to cause server-side parsing of mounted NTFS metadata (e.g., guest/anonymous SMB or permissive NFS read, or unprivileged local open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.
UI:N - After the volume is mounted/exported, exploitation requires only normal remote or local filesystem read/open operations on files whose non-resident attributes carry the poisoned mapping pairs; no additional victim mount dialogs, USB insertion, or other user actions are needed during the attack.
S:U - Impact stays within the kernel/host context (runlist corruption and misdirected block I/O on the mounted volume); it does not cross a VM, container, or IOMMU boundary to another security authority.
C:H - Signed LCN accumulator overflow (undefined behavior) yields attacker-controlled cluster mappings, so subsequent reads can be directed to arbitrary on-volume clusters and disclose other files' data and metadata beyond the accessed object.
I:H - Corrupted LCN values misdirect kernel writeback and allocation I/O to arbitrary physical clusters on the volume, enabling cross-file/metadata tampering and further corruption exploitable for broader integrity compromise.
A:H - Misdirected cluster I/O and corrupt runlists cause mount/read/write failures, can destroy critical structures like $MFT, and repeated remote access can deny service to the host or exported filesystem.
CVSS 3.1