CVE-2023-54125: fs/ntfs3: Return error for inconsistent extended attributes
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Return error for inconsistent extended attributes
ntfsreadea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code for the inconsistent attributes, which might lead to unpredicted memory accesses after return.
[ 138.916927] BUG: KASAN: use-after-free in ntfssetea+0x453/0xbf0 [ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 [ 138.931132] [ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4 [ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 138.947327] Call Trace: [ 138.949557] <TASK> [ 138.951539] dumpstacklvl+0x4d/0x67 [ 138.956834] printreport+0x16f/0x4a6 [ 138.960798] ? ntfssetea+0x453/0xbf0 [ 138.964437] ? kasancompletemodereportinfo+0x7d/0x200 [ 138.969793] ? ntfssetea+0x453/0xbf0 [ 138.973523] kasanreport+0xb8/0x140 [ 138.976740] ? ntfssetea+0x453/0xbf0 [ 138.980578] asanstore4+0x76/0xa0 [ 138.984669] ntfssetea+0x453/0xbf0 [ 138.988115] ? pfxntfssetea+0x10/0x10 [ 138.993390] ? kerneltextaddress+0xd3/0xe0 [ 138.998270] ? kerneltextaddress+0x16/0x50 [ 139.002121] ? unwindgetreturnaddress+0x3e/0x60 [ 139.005659] ? pfxstacktraceconsumeentry+0x10/0x10 [ 139.010177] ? archstackwalk+0xa2/0x100 [ 139.013657] ? filterirqstacks+0x27/0x80 [ 139.017018] ntfssetxattr+0x405/0x440 [ 139.022151] ? pfxntfssetxattr+0x10/0x10 [ 139.026569] ? kvmallocnode+0x2d/0x120 [ 139.030329] ? kasansavestack+0x41/0x60 [ 139.033883] ? kasansavestack+0x2a/0x60 [ 139.037338] ? kasansettrack+0x29/0x40 [ 139.040163] ? kasansaveallocinfo+0x1f/0x30 [ 139.043588] ? kasankmalloc+0x8b/0xa0 [ 139.047255] ? kmallocnode+0x68/0x150 [ 139.051264] ? kvmallocnode+0x2d/0x120 [ 139.055301] ? vmemdupuser+0x2b/0xa0 [ 139.058584] vfssetxattr+0x121/0x170 [ 139.062617] ? pfxvfssetxattr+0x10/0x10 [ 139.066282] vfssetxattrnoperm+0x97/0x300 [ 139.070061] vfssetxattrlocked+0x145/0x170 [ 139.073580] vfssetxattr+0x137/0x2a0 [ 139.076641] ? pfxvfssetxattr+0x10/0x10 [ 139.080223] ? kasancheckwrite+0x18/0x20 [ 139.084234] dosetxattr+0xce/0x150 [ 139.087768] setxattr+0x126/0x140 [ 139.091250] ? pfxsetxattr+0x10/0x10 [ 139.094948] ? virtaddrvalid+0xcb/0x140 [ 139.097838] ? callrcucommon.constprop.0+0x1c7/0x330 [ 139.102688] ? debugsmpprocessorid+0x1b/0x30 [ 139.105985] ? kasanquarantineput+0x5b/0x190 [ 139.109980] ? putname+0x84/0xa0 [ 139.113886] ? kasanslabfree+0x11e/0x1b0 [ 139.117961] ? putname+0x84/0xa0 [ 139.121316] ? preemptcountsub+0x1c/0xd0 [ 139.124427] ? mntwantwrite+0xae/0x100 [ 139.127836] ? mntwantwrite+0x8f/0x150 [ 139.130954] pathsetxattr+0x164/0x180 [ 139.133998] ? pfxpathsetxattr+0x10/0x10 [ 139.137853] ? pfxksyspwrite64+0x10/0x10 [ 139.141299] ? debugsmpprocessorid+0x1b/0x30 [ 139.145714] ? fpregsassertstateconsistent+0x6b/0x80 [ 139.150796] x64syssetxattr+0x71/0x90 [ 139.155407] dosyscall64+0x3f/0x90 [ 139.159035] entrySYSCALL64afterhwframe+0x72/0xdc [ 139.163843] RIP: 0033:0x7f108cae4469 [ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIGRAX: 00000000000000bc [ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469 [ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6 [ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618 [ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0 [ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15 ---truncated---
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54125?
CVE-2023-54125 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-54125?
To mitigate CVE-2023-54125, upgrade to the patched version of the Linux kernel that addresses this issue.
Which versions of the Linux kernel are affected by CVE-2023-54125?
CVE-2023-54125 affects specific versions of the Linux kernel prior to the security patch.
What is the impact of CVE-2023-54125 on system security?
CVE-2023-54125 may allow an attacker to exploit inconsistent extended attributes, leading to unintended behavior in the filesystem.
Is CVE-2023-54125 exploitable remotely?
CVE-2023-54125 is not primarily considered a remote exploitable vulnerability, as exploitation requires local access to the system.