CVE-2024-27407

What it actually does

Missing or incorrect overflow check in mi_enum_attr() within the ntfs3 filesystem driver allows an integer overflow to bypass bounds validation, resulting in out-of-bounds memory access during NTFS attribute enumeration.

Why it matters to the business

Local attackers can trigger kernel memory corruption on systems mounting untrusted NTFS volumes, leading to crashes, denial of service, or potential privilege escalation; widespread Linux distributions and downstream packages are affected until patched.

How an attack unfolds

An attacker prepares a specially crafted NTFS image containing an attribute record that triggers the faulty overflow check in mi_enum_attr(); when the image is mounted on a vulnerable kernel, the driver performs an out-of-bounds read or write, enabling memory corruption that can be leveraged for code execution or system instability. Public threat actor references to Linux kernel out-of-bounds and uninitialized resource issues indicate reconnaissance and potential exploit development by espionage and financially motivated groups.

How to fix it

Upgrade the Linux kernel to a version containing commit e99faa97359654b6e4e769246c72cf50a57e05b2 or later; for gpac apply commit 7e2e92feb1b30fac1d659f6620d743b5a188ffe0. Rebuild and reboot affected systems; avoid mounting untrusted NTFS volumes until updated.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or a backported equivalent; attempt to mount a test NTFS image containing boundary-triggering attributes in a controlled environment and confirm absence of crashes or oops messages; review changelog entries for ntfs3 mi_enum_attr fixes.

Typical attack path

1. Obtain or create a malicious NTFS-formatted image with crafted attribute metadata
2. Place the image on a system accessible to the target user or process
3. Trigger mounting of the image via user action, script, or automated filesystem handler
4. mi_enum_attr() processes the malformed attribute and overflows the bounds check
5. Kernel performs out-of-bounds memory operation leading to corruption or crash

How to detect it

Search kernel logs for ntfs3 or mi_enum_attr related oops, warnings, or out-of-bounds access messages; examine audit logs for unexpected mounts of NTFS volumes from untrusted sources; correlate with process activity that triggers filesystem enumeration shortly before crashes.

What your security team should do

• Apply the kernel and gpac fixes immediately given the high CVSS and local attack vector
• Restrict mounting of removable or untrusted NTFS media via policy or filesystem options until patched
• Monitor for ntfs3-related kernel oops and crashes as indicators of attempted exploitation
• Review systems for downstream package dependencies on the vulnerable ntfs3 code