CVE-2025-22080

What it actually does

Integer overflow in hdr_first_de() when de_off and used values from disk both exceed UINT_MAX-16 on 32-bit systems, bypassing validation checks in ntfs3 driver.

Why it matters to the business

Potential local filesystem parsing bypass on 32-bit Linux systems using ntfs3, increasing risk of corruption or escalation; low urgency given zero EPSS trend, no KEV listing, and 560 days since publication despite listed related kernel issues.

How an attack unfolds

Attacker supplies a malicious NTFS image with oversized de_off/used fields; when mounted on a vulnerable 32-bit kernel the overflow bypasses safety checks in hdr_first_de allowing further malformed metadata processing, similar to other recent kernel privilege-escalation techniques.

How to fix it

Apply kernel patches addressing the ntfs3 integer overflow; for the listed Red Hat postgresql packages on rhel_eus 9.4 update to version 0:13.18-1.el9_4 or later.

How to confirm the fix worked

Verify kernel source contains the hdr_first_de bounds check using UINT_MAX arithmetic; confirm postgresql packages report version 13.18-1.el9_4 after update and test mounting of crafted ntfs images.

Typical attack path

1. Prepare malicious NTFS filesystem image with crafted directory-entry offsets
2. Mount the image on a 32-bit Linux system running vulnerable kernel
3. Trigger hdr_first_de() processing of the oversized values
4. Leverage bypassed validation to access out-of-bounds memory or escalate privileges

How to detect it

Review kernel logs for ntfs3 mount errors or unusual directory-entry processing; inspect auditd or syslog for unexpected ntfs mounts from untrusted sources; correlate with other recent kernel privilege-escalation indicators listed in threat-actor references.

What your security team should do

• Prioritize patching any 32-bit systems using ntfs3
• Monitor for new kernel updates addressing related privilege-escalation CVEs
• Audit use of ntfs3 on legacy 32-bit deployments and migrate to 64-bit where feasible