In the Linux kernel, the following vulnerability has been resolved:
ntfs: add bounds check before accessing EA entries
in ntfs_ea_lookup and ntfs_listxattr, this verifies that there is enough
space in the EA entry before accessing the next_entry_offset field of
the EA entry.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - NTFS registers NFS export ops and is commonly served via nfsd/ksmbd; remote SMB/NFS OPEN, GETXATTR, or LISTXATTRS on an exported NTFS volume reaches ntfs_ea_lookup/ntfs_listxattr on the server without local login.
AC:L - Triggering is deterministic once a crafted $EA/$EA_INFORMATION chain is on disk; the attacker controls next_entry_offset values to land with fewer than sizeof(struct ea_attr) bytes left, forcing the out-of-bounds read every time.
PR:N - Exploitation needs only permission to access files on an exported NTFS share (e.g., guest/anonymous SMB or world-readable NFS); no root, CAP_SYS_ADMIN, or init-namespace privileges are required on the server to hit the parser.
UI:N - After the NTFS volume is mounted server-side, a remote client can trigger parsing automatically via normal file open or xattr RPCs; no additional victim interaction is needed per attack.
S:U - Impact is confined to kernel memory and privileges on the host parsing the NTFS image; it does not cross a VM, container, or IOMMU security boundary by itself.
C:H - The bug reads struct ea_attr fields past the bounded EA query length before validation, causing an out-of-bounds kernel heap read that can disclose adjacent slab memory and feed attacker-influenced values into further EA parsing.
I:H - Malformed next_entry_offset chaining drives additional unchecked memcmp/memcpy over attacker-chosen offsets inside the EA buffer, providing standard kernel heap grooming primitives that can be developed into arbitrary memory corruption and code execution.
A:H - Reading EA headers beyond the allocated or mapped buffer can provoke a kernel oops or panic; even failed exploitation still corrupts kernel parsing state and can crash the affected host on repeated access.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - NTFS registers NFS export ops and is commonly served via nfsd/ksmbd; remote SMB/NFS OPEN, GETXATTR, or LISTXATTRS on an exported NTFS volume reaches ntfs_ea_lookup/ntfs_listxattr on the server without local login.
AC:L - Triggering is deterministic once a crafted $EA/$EA_INFORMATION chain is on disk; the attacker controls next_entry_offset values to land with fewer than sizeof(struct ea_attr) bytes left, forcing the out-of-bounds read every time.
PR:N - Exploitation needs only permission to access files on an exported NTFS share (e.g., guest/anonymous SMB or world-readable NFS); no root, CAP_SYS_ADMIN, or init-namespace privileges are required on the server to hit the parser.
UI:N - After the NTFS volume is mounted server-side, a remote client can trigger parsing automatically via normal file open or xattr RPCs; no additional victim interaction is needed per attack.
S:U - Impact is confined to kernel memory and privileges on the host parsing the NTFS image; it does not cross a VM, container, or IOMMU security boundary by itself.
C:H - The bug reads struct ea_attr fields past the bounded EA query length before validation, causing an out-of-bounds kernel heap read that can disclose adjacent slab memory and feed attacker-influenced values into further EA parsing.
I:H - Malformed next_entry_offset chaining drives additional unchecked memcmp/memcpy over attacker-chosen offsets inside the EA buffer, providing standard kernel heap grooming primitives that can be developed into arbitrary memory corruption and code execution.
A:H - Reading EA headers beyond the allocated or mapped buffer can provoke a kernel oops or panic; even failed exploitation still corrupts kernel parsing state and can crash the affected host on repeated access.
CVSS 3.1