Linux kernel (ntfs) vulnerabilities

In the Linux kernel, the ntfs driver bounds its free-cluster bitmap scan by the size of $Bitmap rather than the volume's cluster count. An image whose $Bitmap covers more clusters than the volume allows indexing past the lcn_empty_bits_per_page array.

In the Linux kernel, the ntfs driver does not reject attributes with empty mapping pairs if they have inconsistent highest VCN and size. The lack of validation can lead to incorrect processing.

In the Linux kernel, parse_ntfs_boot_sector() decodes the NTFS boot sector's 64-bit LCNs into an s64. A crafted high-bit value becomes negative and passes the upper-bound check, leading to an out-of-bounds access to lcn_empty_bits_per_page.

In the Linux kernel, ntfs_attr_update_meta() does not validate the attribute name offset when converting between non-sparse and sparse attributes. A malicious MFT record can set name_offset so the name extends beyond the attribute boundary or overlaps with mapping pairs.

In the Linux kernel, update_reparse_data() in the ntfs driver ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) reports success while no reparse data exists on disk.

In the Linux kernel, write_mft_record_nolock() in the ntfs driver maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. Since kmap_local mappings are stack-ordered per task, leaking one corrupts the nesting for any outer mapping.

In the Linux kernel, ntfs_cluster_free_from_rl_nolock() in the ntfs driver adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters.

In the Linux kernel, ntfs_sync_fs() in the ntfs driver unconditionally clears the dirty bit, whereas ntfs_put_super() and the remount-read-only path only clear it when NVolErrors(vol) is false. As a result, any sync() on a volume that recorded an error marks that volume clean, so no recovery is run.

In the Linux kernel, ntfs_dio_zero_range() in the ntfs driver returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored and newly allocated clusters were folded into initialized_size.

In the Linux kernel, ntfs_attr_find_in_attrdef() in the ntfs driver walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) causes an out-of-bounds read when creating a file.

In the Linux kernel, is_boot_sector_ntfs() in the ntfs driver checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector(), where ffs(0) is 0, making the shift undefined.

In the Linux kernel, ntfs_set_ea() in the ntfs driver unconditionally updates the HasEA flag based on ea_info_qsize in its exit path. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk extended attributes (EAs) until the inode is evicted.

In the Linux kernel NTFS module, ntfs_read_iomap_begin_resident() reads an MFT record without holding ni->mrec_lock, while other functions modify the same buffer under that lock. This causes a data race and allows reading torn attribute length and offset fields. The issue was fixed by holding mrec_lock from the resident iomap read lookup through iomap_end().