ntfs: Add Sanity Check on Allocation Size in Linux Kernel
Summary
GSD-2022-1002218: ntfs: add sanity check on allocation size. Affects Kernel versions < fe41ad8be036a3de3e4bdde709551aeb4de2fe7d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source monolithic Unix-like computer operating system kernel. It provides the essential services for running applications and managing hardware resources. The ntfs module in the Linux Kernel is responsible for handling the NTFS file system commonly used by Windows operating systems. It allows Linux systems to read and write to NTFS partitions. However, a vulnerability has been discovered in the ntfs module that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the ntfs module involves a missing sanity check on allocation size. This could allow an attacker to craft a malicious NTFS file system image with a specially crafted allocation size value. When this image is mounted on a Linux system using the ntfs module, it could lead to a buffer overflow or other memory corruption issues. This could potentially result in arbitrary code execution or a denial of service condition. The vulnerability has been fixed in Linux Kernel version v5.4.189 by commit fe41ad8be036a3de3e4bdde709551aeb4de2fe7d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version as soon as possible.
Conclusion
The vulnerability in the ntfs module of the Linux Kernel could potentially allow an attacker to execute arbitrary code or cause a denial of service. It is crucial to update the Linux Kernel to version v5.4.189 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service on a Linux system with the vulnerable ntfs module.
You can check the version of the Linux Kernel installed on your system. If it is earlier than v5.4.189, your system may be vulnerable.
No, this vulnerability requires the attacker to have access to a specially crafted NTFS file system image and mount it on a Linux system with the vulnerable ntfs module.
There are no known instances of this vulnerability being exploited in the wild.
You can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for more details about the fix and the commit that addresses this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
