CVE-2024-38625

What it actually does

Null pointer dereference in ntfs3 bmap handling when folio is NULL, resulting in memory corruption or kernel panic.

Why it matters to the business

Linux systems using the ntfs3 driver may experience unexpected crashes or potential code execution, disrupting operations on file servers and embedded devices; low exploit probability reduces immediate urgency despite widespread kernel use.

How an attack unfolds

An attacker with local access crafts input that invokes bmap on an ntfs3 filesystem object, passing a NULL folio pointer that is dereferenced without validation, potentially leading to kernel memory corruption.

How to fix it

Apply kernel patches updating ntfs3 to include NULL folio checks; fixed in commit 6c8054d590668629bb2eb6fb4cbf22455d08ada8 for Linux stable and 39f3c86c61ec478720bac9fca8f17ccedb8f052b for ThreadX.

How to confirm the fix worked

Verify patch application by inspecting ntfs3 source for folio NULL checks before bmap usage or confirm updated kernel versions contain the referenced commits.

Typical attack path

1. Obtain local access to a system with ntfs3 filesystem mounted
2. Trigger bmap operation through crafted file or filesystem interaction
3. Cause NULL folio dereference to corrupt kernel memory or crash the system
4. Escalate to arbitrary code execution if memory layout permits

How to detect it

Review kernel logs for ntfs3 NULL pointer dereference oops messages; inspect process activity invoking bmap on ntfs3 volumes.

What your security team should do

• Prioritize patching Linux kernels running ntfs3 on internet-facing or multi-user systems
• Monitor for kernel oops or panic logs related to ntfs3 bmap
• Consider disabling ntfs3 if NTFS volumes are not required
• Test patches in staging before production rollout