CVE-2023-53420: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: Fix panic about slab-out-of-bounds caused by ntfslistxattr()
Here is a BUG report from syzbot:
BUG: KASAN: slab-out-of-bounds in ntfslistea fs/ntfs3/xattr.c:191 [inline] BUG: KASAN: slab-out-of-bounds in ntfslistxattr+0x401/0x570 fs/ntfs3/xattr.c:710 Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
Call Trace: ntfslistea fs/ntfs3/xattr.c:191 [inline] ntfslistxattr+0x401/0x570 fs/ntfs3/xattr.c:710 vfslistxattr fs/xattr.c:457 [inline] listxattr+0x293/0x2d0 fs/xattr.c:804
Fix the logic of eaall iteration. When the ea->namelen is 0, return immediately, or Add2Ptr() would visit invalid memory in the next loop.
[almaz.alexandrovich@paragon-software.com: lines of the patch have changed]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53420?
CVE-2023-53420 has a moderate severity rating as it involves a slab-out-of-bounds issue in the Linux kernel.
How do I fix CVE-2023-53420?
To fix CVE-2023-53420, update the Linux kernel or Paragon Software ntfs3 to the latest patched version.
Which versions of the Linux kernel are affected by CVE-2023-53420?
CVE-2023-53420 affects multiple versions of the Linux kernel prior to the patch being applied.
What does CVE-2023-53420 impact specifically?
CVE-2023-53420 impacts the ntfs_listxattr() function within the Linux kernel's ntfs module.
Is CVE-2023-53420 exploitable remotely?
CVE-2023-53420 is not considered remotely exploitable as it typically requires local access to the affected system.