In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
read_log_rec_buf() copies a log record into a caller buffer starting at
<pre>
u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
</pre>
log->record_header_len (and log->data_off, used for the following pages)
comes verbatim from the on-disk restart area and is only checked for
8-byte alignment in is_rst_area_valid(), so off can exceed
log->page_size. "tail = log->page_size - off" then underflows and
memcpy() reads past the page_size-sized buffer returned by
read_log_page(), spilling adjacent slab memory into the replay buffer.
This is reachable by mounting a crafted NTFS image:
BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580
Read of size 64 at addr ffff88800a877ff8 by task exploit/127
read_log_rec_buf fs/ntfs3/fslog.c:2299
log_replay fs/ntfs3/fslog.c:4216
ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324
ntfs_fill_super fs/ntfs3/super.c:1392
get_tree_bdev_flags fs/super.c:1694
__x64_sys_mount fs/namespace.c:4360
The buggy address is located 4088 bytes to the right of
the 4096-byte region [ffff88800a876000, ffff88800a877000)
Reject an in-page offset outside the current page before the copy.
[almaz.alexandrovich@paragon-software.com: replaced the >= sign with >]
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.4
AV:L - The OOB read is reached only while mounting a local NTFS volume (path_mount→ntfs_fill_super→ntfs_loadlog_and_replay→log_replay→read_rst_area/find_log_rec→read_log_rec_buf). ksmbd/nfsd never parse $LogFile; journal replay runs at fill_super, not while serving exported files.
AC:L - rec_hdr_len and data_off in the on-disk restart area are attacker-controlled and only checked for 8-byte alignment, so off=lsn_to_page_off()+record_header_len (and later data_off) can exceed page_size. The u32 tail underflow and memcpy past the kmalloc(page_size) log page are deterministic with no race.
PR:N - No account or privilege on the victim is required: a crafted NTFS volume on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to run $LogFile replay as root.
UI:N - Desktop, kiosk, automotive, and shared-workstation automounters mount attacker-supplied NTFS media and run log_replay() inside ntfs_fill_super() without the user opening files or confirming a dialog; attaching the crafted volume is sufficient.
S:U - The slab out-of-bounds read occurs in the host kernel during ntfs3 journal replay in the mounting process; impact stays within one kernel security authority and is not a VM escape or IOMMU/DMA bypass.
C:H - memcpy() copies attacker-chosen client_data_len bytes from past the page_size log-page slab into the replay buffer, spilling adjacent heap. client_data_len is only bounded by kmalloc success on the restart-area path, so this is an unbounded heap OOB read (Confidentiality High), not a few-byte leak.
I:H - With a valid rec_hdr_len and oversized data_off, multi-page log records keep an attacker-controlled LOG_REC_HDR then fill the rest from adjacent slab (including same-size log pages from the crafted image). do_action then memmove()s that buffer into kmalloc'd MFT and index objects, yielding kernel writes from attacker-influenced heap contents.
A:H - An oversized rec_hdr_len or data_off plus a large client_data_len drives memcpy() far past the 4KiB log-page allocation into unmapped slab or guard pages, causing a kernel oops or panic on mount. The crash is repeatable on every mount of the crafted NTFS volume.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The OOB read is reached only while mounting a local NTFS volume (path_mount→ntfs_fill_super→ntfs_loadlog_and_replay→log_replay→read_rst_area/find_log_rec→read_log_rec_buf). ksmbd/nfsd never parse $LogFile; journal replay runs at fill_super, not while serving exported files.
AC:L - rec_hdr_len and data_off in the on-disk restart area are attacker-controlled and only checked for 8-byte alignment, so off=lsn_to_page_off()+record_header_len (and later data_off) can exceed page_size. The u32 tail underflow and memcpy past the kmalloc(page_size) log page are deterministic with no race.
PR:N - No account or privilege on the victim is required: a crafted NTFS volume on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to run $LogFile replay as root.
UI:N - Desktop, kiosk, automotive, and shared-workstation automounters mount attacker-supplied NTFS media and run log_replay() inside ntfs_fill_super() without the user opening files or confirming a dialog; attaching the crafted volume is sufficient.
S:U - The slab out-of-bounds read occurs in the host kernel during ntfs3 journal replay in the mounting process; impact stays within one kernel security authority and is not a VM escape or IOMMU/DMA bypass.
C:H - memcpy() copies attacker-chosen client_data_len bytes from past the page_size log-page slab into the replay buffer, spilling adjacent heap. client_data_len is only bounded by kmalloc success on the restart-area path, so this is an unbounded heap OOB read (Confidentiality High), not a few-byte leak.
I:H - With a valid rec_hdr_len and oversized data_off, multi-page log records keep an attacker-controlled LOG_REC_HDR then fill the rest from adjacent slab (including same-size log pages from the crafted image). do_action then memmove()s that buffer into kmalloc'd MFT and index objects, yielding kernel writes from attacker-influenced heap contents.
A:H - An oversized rec_hdr_len or data_off plus a large client_data_len drives memcpy() far past the 4KiB log-page allocation into unmapped slab or guard pages, causing a kernel oops or panic on mount. The crash is repeatable on every mount of the crafted NTFS volume.
CVSS 3.1