CVE-2023-53294: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Fix null-ptr-deref on inode->iop in ntfslookup()
Syzbot reported a null-ptr-deref bug:
ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512) ntfs3: loop0: Mark volume as dirty due to NTFS errors general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:dflagsforinode fs/dcache.c:1980 [inline] RIP: 0010:dadd+0x5ce/0x800 fs/dcache.c:2796 Call Trace: <TASK> dsplicealias+0x122/0x3b0 fs/dcache.c:3191 lookupopen fs/namei.c:3391 [inline] openlastlookups fs/namei.c:3481 [inline] pathopenat+0x10e6/0x2df0 fs/namei.c:3688 dofilpopen+0x264/0x4f0 fs/namei.c:3718 dosysopenat2+0x124/0x4e0 fs/open.c:1310 dosysopen fs/open.c:1326 [inline] dosysopen fs/open.c:1334 [inline] sesysopen fs/open.c:1330 [inline] x64sysopen+0x221/0x270 fs/open.c:1330 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
If the MFT record of ntfs inode is not a base record, inode->iop can be NULL. And a null-ptr-deref may happen:
ntfslookup() dirsearchu() # inode->iop is set to NULL dsplicealias() dadd() dflagsforinode() # inode->iop->getlink null-ptr-deref
Fix this by adding a Check on inode->iop before calling the dsplicealias() function.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53294?
CVE-2023-53294 has been classified as a high severity vulnerability due to the potential for exploitation through null pointer dereference.
How do I fix CVE-2023-53294?
To fix CVE-2023-53294, update your Linux kernel to the latest version that includes the patches addressing this vulnerability.
What systems are affected by CVE-2023-53294?
CVE-2023-53294 affects the Linux Kernel, specifically systems utilizing the NTFS file system.
What type of vulnerability is CVE-2023-53294?
CVE-2023-53294 is a null pointer dereference vulnerability that occurs during the handling of NTFS file systems.
What might happen if CVE-2023-53294 is exploited?
If exploited, CVE-2023-53294 could lead to system crashes or denial of service conditions due to unexpected behavior in the kernel.