CVE-2024-52560

What it actually does

The mi_enum_attr() function did not immediately mark the ntfs_inode as bad upon error detection, allowing continued processing of corrupted attribute data.

Why it matters to the business

Systems using affected NTFS3 drivers could experience unexpected file system errors or crashes; the package listed has a long-published fix and low exploitation likelihood so operational risk remains minimal.

How an attack unfolds

An attacker supplies a malformed NTFS image or on-disk structure that triggers an error inside mi_enum_attr(); without immediate inode invalidation the kernel may dereference invalid data leading to a crash or information leak.

How to fix it

Upgrade django-grappelli to version 2.15.2 or later; for Linux kernels apply the referenced commit that adds the ni parameter and marks the inode bad on first error.

How to confirm the fix worked

Confirm the running kernel contains the mi_enum_attr() signature change and that django-grappelli reports version 2.15.2 or higher; attempt to mount a test malformed image and verify the inode is promptly marked bad.

Typical attack path

1. Mount a specially crafted NTFS volume or image
2. Trigger enumeration of attributes via normal file-system operations
3. Force an error path in mi_enum_attr()
4. Continue using the now-inconsistent inode to induce kernel fault or data corruption

How to detect it

Review kernel logs for ntfs3 error paths around inode enumeration; look for sudden inode invalidation messages or unexpected file-system mounts of external media.

What your security team should do

• Apply the published fixed version of django-grappelli immediately
• Update Linux kernels containing the ntfs3 driver to a release that includes the fix
• Monitor EPSS and KEV status for any future increase in exploit activity