Cloudanix VulnDB

CVE-2023-53486

None

CVSS

—

EPSS

0.2%

Published

Oct 1, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain disk formats can let a specially made USB drive or file system image crash the computer or leak memory when plugged in or mounted.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient boundary and overflow checks during NTFS attribute enumeration allow a slab-out-of-bounds read in run_unpack when loading runs for an inode, triggered during mount of a crafted ntfs3 volume.

Why it matters to the business

Systems using the ntfs3 driver can experience kernel crashes or memory disclosure when an attacker-supplied NTFS image is mounted, disrupting file system access and requiring reboots or forensic investigation.

How an attack unfolds

An attacker prepares an NTFS volume containing attributes that exceed the expected size bounds, causes the victim to mount the volume (via local disk, USB, or network share), and the ntfs_fill_super path calls run_unpack_ex which performs the out-of-bounds read.

How to fix it

Upgrade the Linux kernel to a version containing commit 1fd5b80c9339503f3eaa4db3051b37ac506beeab which merges the overflow and boundary checks for all attributes.

How to confirm the fix worked

Verify the running kernel contains commit 1fd5b80c9339503f3eaa4db3051b37ac506beeab or is newer than the vulnerable 6.0-rc7-era trees; attempt to mount a test volume that previously triggered the KASAN report.

Typical attack path

  1. Craft NTFS image with oversized or malformed attributes
  2. Place image on removable media or network share accessible to target
  3. Trigger mount operation (manual, auto-mount, or via malware)
  4. ntfs_iget5 → mi_read → attr_load_runs_vcn → run_unpack_ex executes out-of-bounds read
  5. Kernel KASAN report or silent memory corruption occurs

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for strings matching the provided KASAN report: 'BUG: KASAN: slab-out-of-bounds in run_unpack', 'Read of size 1 at addr', and the call trace containing ntfs_fill_super and run_unpack_ex; correlate with recent mount syscalls of ntfs3 volumes.

  • BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570
  • Read of size 1 at addr ffff8880
  • run_unpack+0x2e3/0x570
  • ntfs_fill_super+0x1026/0x1ba0
  • ntfs_iget5+0x277/0x1780

What your security team should do

  • Apply the referenced kernel commit or distribution backport immediately on any system exposing ntfs3 mounts
  • Disable ntfs3 module (modprobe.blacklist=ntfs3) until patched if mounting untrusted volumes is unnecessary
  • Monitor mount logs and kernel oops for KASAN or slab-out-of-bounds reports involving run_unpack
  • Restrict local mount privileges for untrusted media via policy or udev rules

The record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Enhance the attribute size check This combines the overflow and boundary check so that all attribute size will be properly examined while enumerating them. [ 169.181521] BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570 [ 169.183161] Read of size 1 at addr ffff8880094b6240 by task mount/247 [ 169.184046] [ 169.184925] CPU: 0 PID: 247 Comm: mount Not tainted 6.0.0-rc7+ #3 [ 169.185908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 169.187066] Call Trace: [ 169.187492] <TASK> [ 169.188049] dump_stack_lvl+0x49/0x63 [ 169.188495] print_report.cold+0xf5/0x689 [ 169.188964] ? run_unpack+0x2e3/0x570 [ 169.189331] kasan_report+0xa7/0x130 [ 169.189714] ? run_unpack+0x2e3/0x570 [ 169.190079] __asan_load1+0x51/0x60 [ 169.190634] run_unpack+0x2e3/0x570 [ 169.191290] ? run_pack+0x840/0x840 [ 169.191569] ? run_lookup_entry+0xb3/0x1f0 [ 169.192443] ? mi_enum_attr+0x20a/0x230 [ 169.192886] run_unpack_ex+0xad/0x3e0 [ 169.193276] ? run_unpack+0x570/0x570 [ 169.193557] ? ni_load_mi+0x80/0x80 [ 169.193889] ? debug_smp_processor_id+0x17/0x20 [ 169.194236] ? mi_init+0x4a/0x70 [ 169.194496] attr_load_runs_vcn+0x166/0x1c0 [ 169.194851] ? attr_data_write_resident+0x250/0x250 [ 169.195188] mi_read+0x133/0x2c0 [ 169.195481] ntfs_iget5+0x277/0x1780 [ 169.196017] ? call_rcu+0x1c7/0x330 [ 169.196392] ? ntfs_get_block_bmap+0x70/0x70 [ 169.196708] ? evict+0x223/0x280 [ 169.197014] ? __kmalloc+0x33/0x540 [ 169.197305] ? wnd_init+0x15b/0x1b0 [ 169.197599] ntfs_fill_super+0x1026/0x1ba0 [ 169.197994] ? put_ntfs+0x1d0/0x1d0 [ 169.198299] ? vsprintf+0x20/0x20 [ 169.198583] ? mutex_unlock+0x81/0xd0 [ 169.198930] ? set_blocksize+0x95/0x150 [ 169.199269] get_tree_bdev+0x232/0x370 [ 169.199750] ? put_ntfs+0x1d0/0x1d0 [ 169.200094] ntfs_fs_get_tree+0x15/0x20 [ 169.200431] vfs_get_tree+0x4c/0x130 [ 169.200714] path_mount+0x654/0xfe0 [ 169.201067] ? putname+0x80/0xa0 [ 169.201358] ? finish_automount+0x2e0/0x2e0 [ 169.201965] ? putname+0x80/0xa0 [ 169.202445] ? kmem_cache_free+0x1c4/0x440 [ 169.203075] ? putname+0x80/0xa0 [ 169.203414] do_mount+0xd6/0xf0 [ 169.203719] ? path_mount+0xfe0/0xfe0 [ 169.203977] ? __kasan_check_write+0x14/0x20 [ 169.204382] __x64_sys_mount+0xca/0x110 [ 169.204711] do_syscall_64+0x3b/0x90 [ 169.205059] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 169.205571] RIP: 0033:0x7f67a80e948a [ 169.206327] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 169.208296] RSP: 002b:00007ffddf020f58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 169.209253] RAX: ffffffffffffffda RBX: 000055e2547a6060 RCX: 00007f67a80e948a [ 169.209777] RDX: 000055e2547a6260 RSI: 000055e2547a62e0 RDI: 000055e2547aeaf0 [ 169.210342] RBP: 0000000000000000 R08: 000055e2547a6280 R09: 0000000000000020 [ 169.210843] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055e2547aeaf0 [ 169.211307] R13: 000055e2547a6260 R14: 0000000000000000 R15: 00000000ffffffff [ 169.211913] </TASK> [ 169.212304] [ 169.212680] Allocated by task 0: [ 169.212963] (stack is not available) [ 169.213200] [ 169.213472] The buggy address belongs to the object at ffff8880094b5e00 [ 169.213472] which belongs to the cache UDP of size 1152 [ 169.214095] The buggy address is located 1088 bytes inside of [ 169.214095] 1152-byte region [ffff8880094b5e00, ffff8880094b6280) [ 169.214639] [ 169.215004] The buggy address belongs to the physical page: [ 169.215766] page:000000002e324c8c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94b4 [ 169.218412] head:000000002e324c8c order:2 compound_mapcount:0 compound_pincount:0 [ 169.219078] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 169.220272] raw: 000fffffc0010200 ---truncated---

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.15.0 5.15.113

Related vulnerabilities