CVE-2023-53328

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Enhance sanity check while generating attr_list

ni_create_attr_list uses WARN_ON to catch error cases while generating

attribute list, which only prints out stack trace and may not be enough.

This repalces them with more proper error handling flow.

[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e

[ 59.673268] #PF: supervisor read access in kernel mode

[ 59.678354] #PF: error_code(0x0000) - not-present page

[ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0

[ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI

[ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4

[ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

[ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860

[ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References