CVE-2023-52631

What it actually does

Integer overflow on 32-bit systems when computing allocation size from attr->res.data_size in ntfs_load_attr_list leads to kmalloc returning ZERO_SIZE_PTR followed by memcpy crash causing NULL dereference.

Why it matters to the business

Kernel oops and system instability on 32-bit Linux systems when handling certain NTFS attributes; forces reboots or service disruption in environments using the ntfs3 driver.

How an attack unfolds

An attacker crafts an NTFS image containing an attribute list entry whose data_size value triggers the +1023 overflow on 32-bit, mounts the image triggering ntfs_load_attr_list, and causes the kernel to dereference ZERO_SIZE_PTR during memcpy.

How to fix it

Update the Linux kernel to commit ae4acad41b0f93f1c26cc0fc9135bb79d8282d0b or later stable release containing the ntfs3 fix; disable ntfs3 module if upgrade is not immediately possible.

How to confirm the fix worked

Confirm kernel source contains ae4acad41b0f93f1c26cc0fc9135bb79d8282d0b, verify ntfs3.ko version after rebuild, and test mount of previously crashing NTFS images on 32-bit systems without oops.

Typical attack path

1. Prepare malicious NTFS filesystem image with crafted attribute list entry
2. Trigger mount or filesystem access that invokes ntfs_load_attr_list on a 32-bit kernel
3. Kernel performs le32_to_cpu then adds 1023 causing wrap to zero
4. kmalloc returns ZERO_SIZE_PTR and subsequent memcpy triggers oops

How to detect it

Search kernel logs for ntfs3 oops or NULL dereference around ntfs_load_attr_list; examine dmesg and syslog for ZERO_SIZE_PTR memcpy failures on 32-bit kernels after NTFS mount attempts.

What your security team should do

• Prioritize kernel upgrade on all 32-bit systems using ntfs3 within 30 days
• Audit systems for ntfs3 usage and restrict untrusted NTFS mounts
• Monitor kernel logs for ntfs3-related oops entries