CVE-2023-45896

What it actually does

Out-of-bounds read in the ntfs3 driver allows a local attacker who can mount a crafted filesystem image to read beyond allocated kernel memory buffers, disclosing kernel heap contents.

Why it matters to the business

Organizations permitting unprivileged users to mount removable media or loopback images on Linux systems risk exposure of sensitive kernel memory that could contain credentials, encryption keys, or other confidential data; the issue affects a wide range of distributions and has been public for over two years.

How an attack unfolds

An attacker prepares a malicious NTFS image containing a crafted length field larger than the allocated buffer, mounts it on a Linux system configured to allow unprivileged mounts, then triggers the ntfs3 code path that performs the oversized read, leaking kernel memory to user space.

How to fix it

Update the Linux kernel to a version containing commit 013ff63b649475f0ee134e2c8d0c8e65284ede50 or later; disable unprivileged mounting of filesystems via sysctl or mount options where possible; restrict physical access to systems that accept removable media.

How to confirm the fix worked

Verify the running kernel contains commit 013ff63b649475f0ee134e2c8d0c8e65284ede50 or is newer than 6.8.0; attempt to reproduce the out-of-bounds condition with a crafted image in a test environment and confirm the read no longer exceeds buffer bounds.

Typical attack path

1. Obtain or create a malicious NTFS filesystem image with an oversized length field
2. Gain the ability to mount the image (physical access to removable media or unprivileged mount permissions)
3. Mount the image using the ntfs3 driver
4. Trigger the code path that reads the oversized length value
5. Read the leaked kernel memory from the resulting buffer

How to detect it

Review kernel logs for ntfs3 mount and error messages around the time of suspected activity; examine audit logs for unprivileged mount attempts; look for processes that open loop devices or mount NTFS volumes from untrusted sources.

What your security team should do

• Immediately apply the referenced kernel commit or distribution update on all systems that use ntfs3
• Disable unprivileged filesystem mounts via kernel parameters or AppArmor/SELinux policies
• Audit systems for ntfs3 usage and removable-media mount policies
• Monitor for future ntfs3-related kernel updates given the driver history