CVE-2023-54077

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix memory leak if ntfs_read_mft failed

Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and

ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC

and alloc ni->dir.alloc_run. However two states are not always

consistent and can make memory leak.

1) attr_name in ATTR_ROOT does not fit the condition it will set

is_root = true but NI_FLAG_DIR is not set.

2) next attr_name in ATTR_ALLOC fits the condition and alloc

ni->dir.alloc_run

3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees

ni->dir.alloc_run, otherwise it frees ni->file.run

4) because NI_FLAG_DIR is not set in this case, ni->dir.alloc_run is

leaked as kmemleak reported:

unreferenced object 0xffff888003bc5480 (size 64):

backtrace:

[<000000003d42e6b0>] __kmalloc_node+0x4e/0x1c0

[<00000000d8e19b8a>] kvmalloc_node+0x39/0x1f0

[<00000000fc3eb5b8>] run_add_entry+0x18a/0xa40 [ntfs3]

[<000000

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References