In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate non-resident attribute offsets
ntfs_attr_update_meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse also adds the
compressed_size field before the name and mapping pairs, requiring eight
additional bytes in the attribute record.
However, the validator does not check that name_offset is within safe
boundaries for these operations or that the additional space is available.
A malicious MFT record could set name_offset such that:
-
The name is positioned at the very end of a non-sparse attribute.
Converting to sparse would shift the name forward by 8 bytes,
writing beyond the attribute boundary.
-
The name overlaps with the mapping pairs, causing corruption during
conversion.
Add validation to ensure:
- For named attributes, name_offset is within valid bounds
- Name does not extend beyond the attribute or overlap with mapping pairs
- For non-sparse, non-compressed attributes, eight bytes are available
after mapping_pairs_offset for the compressed_size field
The space check also covers unnamed attributes, for which name_offset = 0
is valid and no name range needs to be checked.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - fs/ntfs registers ntfs_export_ops, so ksmbd/nfsd VFS write, truncate, create, and ksmbd vfs_fallocate(FALLOC_FL_PUNCH_HOLE) on an exported NTFS volume reach ntfs_attr_update_mapping_pairs() → ntfs_attr_update_meta() without local shell access.
AC:L - A crafted MFT record with a malicious name_offset or too little mapping-pairs slack makes ntfs_attr_update_meta() memmove the name or add compressed_size on every attacker-driven punch-hole, sparse extend, or directory update; no race or uninfluenced layout is required.
PR:N - Exploitation needs only write or create access on the mounted NTFS volume, including guest/anonymous SMB or world-writable NFS on a misconfigured export and automounted removable media; no init-namespace root or CAP_SYS_ADMIN is required.
UI:N - Once the NTFS volume is rw-mounted and optionally exported (or automounted from shared/removable storage), the attacker triggers sparsity conversion via fallocate, truncate, write, or create; no further victim clicks or cooperative opens are needed.
S:U - The overflow corrupts the kmalloc MFT-record buffer and adjacent host-kernel heap during filesystem metadata updates; this is standard kernel privilege impact, not a VM escape, IOMMU bypass, or sandbox scope change.
C:H - memmove of the attacker-controlled attribute name and later mapping-pairs builds write past the kmalloc(mft_record_size) slab into neighboring objects, which per kernel CNA guidance yields an information-disclosure primitive from corrupted adjacent heap contents.
I:H - Converting to or from sparse performs an out-of-bounds heap write of attacker-chosen name bytes and can shift mapping_pairs_offset so ntfs_mapping_pairs_build() stores runs past the record, enabling slab corruption and control-flow hijack.
A:H - Overflowing the kmalloc MFT-record slab into adjacent memory can oops or panic the kernel, and even failed exploitation leaves inconsistent MFT metadata that crashes later lookups or writeback.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - fs/ntfs registers ntfs_export_ops, so ksmbd/nfsd VFS write, truncate, create, and ksmbd vfs_fallocate(FALLOC_FL_PUNCH_HOLE) on an exported NTFS volume reach ntfs_attr_update_mapping_pairs() → ntfs_attr_update_meta() without local shell access.
AC:L - A crafted MFT record with a malicious name_offset or too little mapping-pairs slack makes ntfs_attr_update_meta() memmove the name or add compressed_size on every attacker-driven punch-hole, sparse extend, or directory update; no race or uninfluenced layout is required.
PR:N - Exploitation needs only write or create access on the mounted NTFS volume, including guest/anonymous SMB or world-writable NFS on a misconfigured export and automounted removable media; no init-namespace root or CAP_SYS_ADMIN is required.
UI:N - Once the NTFS volume is rw-mounted and optionally exported (or automounted from shared/removable storage), the attacker triggers sparsity conversion via fallocate, truncate, write, or create; no further victim clicks or cooperative opens are needed.
S:U - The overflow corrupts the kmalloc MFT-record buffer and adjacent host-kernel heap during filesystem metadata updates; this is standard kernel privilege impact, not a VM escape, IOMMU bypass, or sandbox scope change.
C:H - memmove of the attacker-controlled attribute name and later mapping-pairs builds write past the kmalloc(mft_record_size) slab into neighboring objects, which per kernel CNA guidance yields an information-disclosure primitive from corrupted adjacent heap contents.
I:H - Converting to or from sparse performs an out-of-bounds heap write of attacker-chosen name bytes and can shift mapping_pairs_offset so ntfs_mapping_pairs_build() stores runs past the record, enabling slab corruption and control-flow hijack.
A:H - Overflowing the kmalloc MFT-record slab into adjacent memory can oops or panic the kernel, and even failed exploitation leaves inconsistent MFT metadata that crashes later lookups or writeback.
CVSS 3.1