CVE-2024-50245

What it actually does

Race condition in ntfs3 allows inconsistent mutex subclass acquisition between mi_read and ni_lock_dir, resulting in deadlock and denial of service.

Why it matters to the business

Local processes can cause the system to hang when accessing NTFS volumes, leading to operational disruption and potential data access loss until reboot.

How an attack unfolds

A local attacker mounts or accesses an NTFS3 volume and performs directory and file operations that trigger nested locking with mismatched subclasses, deadlocking the kernel thread.

How to fix it

Upgrade affected packages to the fixed versions: flashplugin-nonfree (Ubuntu:14.04:LTS) fixed in 11.2.202.535ubuntu0.14.04.1. Reboot after applying kernel-related updates if applicable.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases and verify no deadlock symptoms occur under concurrent directory operations on NTFS3.

Typical attack path

1. Obtain local user access on a system with ntfs3 driver loaded
2. Mount or interact with an NTFS volume
3. Issue sequences of directory and metadata read operations to induce lock order violation
4. Trigger deadlock in mi_read path

How to detect it

Review system logs for hung task warnings or deadlock reports involving ntfs3 and mi_read functions; inspect for repeated failed I/O on NTFS volumes.

What your security team should do

• Prioritize patching systems with ntfs3 usage within standard change windows
• Monitor for high CPU or hung tasks related to ntfs3
• Restrict local access where possible until patched