NetSight
IP …
medium5.5

CVE-2023-52631

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_…

Impact

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can overflow and the result is zero. This means that the kmalloc will succeed by returning the ZERO_SIZE_PTR and then the memcpy() will crash with an Oops on the next line.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.15 before 5.15.149
from 5.16 before 6.1.78
from 6.2 before 6.6.17
from 6.7 before 6.7.5
Version 6.8

Weakness classification

CWE-476

References