CVE-2024-38623

What it actually does

The ntfs_set_label function performed a memcpy of up to 256 bytes into a fixed 20-byte uni->name array, enabling an out-of-bounds write that can corrupt adjacent kernel memory.

Why it matters to the business

Attackers may achieve kernel-level code execution or trigger system crashes on Linux hosts that mount attacker-controlled NTFS volumes, leading to full host compromise, data theft, or denial of service.

How an attack unfolds

An attacker supplies a malicious NTFS volume containing an oversized label. When the kernel processes the volume (via mount, fsck, or label operations), ntfs_set_label copies the oversized label into the undersized fixed array, corrupting kernel structures and allowing arbitrary code execution.

How to fix it

Upgrade the Linux kernel to the commit a2de301d90b782ac5d7a5fe32995caaee9ab3a0f or later stable releases that replace the fixed-size array with a variable-length array in ntfs_set_label.

How to confirm the fix worked

Confirm the presence of commit a2de301d90b782ac5d7a5fe32995caaee9ab3a0f in the running kernel source or verify that the ntfs_set_label function now allocates the name array dynamically based on label length.

Typical attack path

1. Attacker crafts NTFS filesystem image with label exceeding 20 bytes
2. Victim mounts or otherwise processes the malicious volume on a vulnerable kernel
3. ntfs_set_label is invoked and performs unsafe memcpy
4. Out-of-bounds write corrupts kernel memory and redirects execution
5. Attacker gains kernel privileges or causes denial of service

How to detect it

Review kernel logs and audit records for ntfs_set_label calls or memcpy warnings on systems that process external NTFS volumes; correlate with volume mount events from untrusted sources.

What your security team should do

• Prioritize kernel updates to the fixed commit on all systems using the ntfs3 driver
• Restrict mounting of untrusted NTFS volumes until patches are applied
• Monitor kernel logs for ntfs-related warnings or crashes during volume operations