In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid empty mapping pairs
Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS reads on an exported NTFS volume reach ntfs_map_runlist()->ntfs_mapping_pairs_decompress() for crafted on-disk mapping pairs without local shell access.
AC:L - The attacker fully controls the empty mapping-pairs terminator, lowest/highest VCN, and allocated/data/initialized sizes; decompressing that attribute and merging the resulting degenerate runlist is deterministic with no race or victim-specific layout.
PR:N - Triggering the decoder needs only permission to cause server-side parsing of mounted NTFS metadata (guest/anonymous SMB or a permissive NFS export, or an unprivileged open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.
UI:N - After the crafted volume is mounted and exported, ordinary remote or local reads decompress the invalid empty mapping pairs and enter the merge path; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.
S:U - Heap corruption of the in-memory runlist and subsequent misdirected cluster I/O remain in the host kernel security domain and do not cross a VM, container, or IOMMU boundary to another authority.
C:H - Merging the degenerate unmapped runlist computes a negative source size and indexes src+ssize-1 / dst[marker] outside the allocation, an unbounded kernel heap out-of-bounds read that can disclose adjacent objects.
I:H - The same merge performs out-of-bounds runlist writes via marker/loc arithmetic with ssize<0 and later I/O using corrupted VCN/LCN mappings, a kernel heap write primitive sufficient for control-flow hijacking.
A:H - WARN_ON on an entirely unmapped source runlist, heap out-of-bounds access, and corrupted runlist walks oops or panic the kernel, fully denying availability even when exploitation is not completed.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - fs/ntfs registers ntfs_export_ops, so nfsd/ksmbd VFS reads on an exported NTFS volume reach ntfs_map_runlist()->ntfs_mapping_pairs_decompress() for crafted on-disk mapping pairs without local shell access.
AC:L - The attacker fully controls the empty mapping-pairs terminator, lowest/highest VCN, and allocated/data/initialized sizes; decompressing that attribute and merging the resulting degenerate runlist is deterministic with no race or victim-specific layout.
PR:N - Triggering the decoder needs only permission to cause server-side parsing of mounted NTFS metadata (guest/anonymous SMB or a permissive NFS export, or an unprivileged open/read on an already-mounted volume), not init-namespace root or CAP_SYS_ADMIN at trigger time.
UI:N - After the crafted volume is mounted and exported, ordinary remote or local reads decompress the invalid empty mapping pairs and enter the merge path; no extra victim mount dialog, USB insertion, or confirmation is required during the attack.
S:U - Heap corruption of the in-memory runlist and subsequent misdirected cluster I/O remain in the host kernel security domain and do not cross a VM, container, or IOMMU boundary to another authority.
C:H - Merging the degenerate unmapped runlist computes a negative source size and indexes src+ssize-1 / dst[marker] outside the allocation, an unbounded kernel heap out-of-bounds read that can disclose adjacent objects.
I:H - The same merge performs out-of-bounds runlist writes via marker/loc arithmetic with ssize<0 and later I/O using corrupted VCN/LCN mappings, a kernel heap write primitive sufficient for control-flow hijacking.
A:H - WARN_ON on an entirely unmapped source runlist, heap out-of-bounds access, and corrupted runlist walks oops or panic the kernel, fully denying availability even when exploitation is not completed.
CVSS 3.1