CVE-2024-50247

What it actually does

An incorrectly formatted NTFS chunk may decompress into more than LZNT_CHUNK_SIZE bytes, triggering an index out of bounds access in s_max_off within the ntfs3 driver and resulting in memory corruption.

Why it matters to the business

Local memory corruption on Linux systems can lead to crashes, data corruption, or potential privilege escalation, increasing operational risk and requiring urgent patching on affected kernels.

How an attack unfolds

A local attacker supplies a maliciously crafted NTFS chunk that exceeds expected decompression limits, causing the ntfs3 driver to perform an out-of-bounds operation that an attacker can leverage for memory corruption.

How to fix it

Apply kernel updates that include the ntfs3 bounds check fix; for listed packages update flashplugin-nonfree (Ubuntu:14.04:LTS) to 11.2.202.535ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the presence of the decompression size check in fs/ntfs3 source and verify that decompression results are bounded by LZNT_CHUNK_SIZE before accessing s_max_off structures.

Typical attack path

1. Obtain local access on a target Linux system
2. Prepare a malicious NTFS volume or file with oversized compressed chunks
3. Trigger chunk decompression via file access or mount
4. Exploit resulting out-of-bounds condition for corruption or escalation

How to detect it

Review kernel logs and audit records for ntfs3 decompression errors or out-of-bounds accesses; look for unexpected crashes when accessing NTFS volumes.

What your security team should do

• Prioritize kernel updates on all Linux systems using ntfs3
• Restrict untrusted NTFS volume mounting until patched
• Monitor for local privilege escalation attempts involving file system drivers