CVE-2022-49763

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix use-after-free in ntfs_attr_find()

Patch series "ntfs: fix bugs about Attribute", v2.

This patchset fixes three bugs relative to Attribute in record:

Patch 1 adds a sanity check to ensure that, attrs_offset field in first

mft record loading from disk is within bounds.

Patch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid

dereferencing ATTR_RECORD before checking this ATTR_RECORD is within

bounds.

Patch 3 adds an overflow checking to avoid possible forever loop in

ntfs_attr_find().

Without patch 1 and patch 2, the kernel triggersa KASAN use-after-free

detection as reported by Syzkaller.

Although one of patch 1 or patch 2 can fix this, we still need both of

them. Because patch 1 fixes the root cause, and patch 2 not only fixes

the direct cause, but also fixes the potential out-of-bounds bug.

This patch (of 3):

Syzkaller reported use-after-free read as follows:

===========================

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References