CVE-2023-4693

What it actually does

Out-of-bounds read in the NTFS filesystem driver that permits a physically present attacker to read arbitrary memory locations or EFI variable values from a specially crafted NTFS image.

Why it matters to the business

Potential exposure of sensitive cached data or configuration secrets if an attacker gains brief physical access to present malicious boot media; low prevalence in most environments but relevant where QEMU or GRUB2 NTFS handling is used.

How an attack unfolds

An attacker with physical access crafts a malicious NTFS filesystem image and presents it via removable media or boot device; the driver processes the image and leaks memory contents due to the out-of-bounds read. Public exploit code is available but requires physical presence.

How to fix it

Update qemu-project/qemu to the fixed commit 4743c23509a51bd4ee85cc272287a41917d1be35; rebuild and redeploy any affected QEMU-based images or virtual machine tooling that incorporates the vulnerable NTFS driver code.

How to confirm the fix worked

Confirm the patched commit is present in the source tree; perform regression testing by attempting to mount known-malicious NTFS images in a controlled environment and verify no memory disclosure occurs.

Typical attack path

1. Obtain brief physical access to the target system
2. Prepare a specially crafted NTFS filesystem image containing malformed structures
3. Attach the image via USB, DVD, or other bootable media
4. Boot or mount the image to trigger NTFS driver parsing
5. Capture leaked memory or EFI variable data from the resulting read

How to detect it

Review boot and filesystem mount logs for unexpected NTFS volumes; inspect system memory dumps or EFI variable access patterns following physical access events; correlate with physical security logs for unauthorized device attachments.

What your security team should do

• Apply the upstream fix to all QEMU builds that embed the affected driver
• Enforce physical security controls and boot media policies to reduce attack surface
• Monitor for new public exploits targeting the NTFS driver and reassess if EPSS rises