Riskcovery

CVE-2023-53420

ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()

State
Published
Severity
7.1 High
Published
Sep 18, 2025
Updated
Aug 5, 2026
Reserved
Sep 17, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()

Here is a BUG report from syzbot:

BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632

Call Trace: ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 vfs_listxattr fs/xattr.c:457 [inline] listxattr+0x293/0x2d0 fs/xattr.c:804

Fix the logic of ea_all iteration. When the ea->name_len is 0, return immediately, or Add2Ptr() would visit invalid memory in the next loop.

[almaz.alexandrovich@paragon-software.com: lines of the patch have changed]

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • be71b5cba2e6485e8959da7a9f9a44461a1bb074 to before f3380d895e28a32632eb3609f5bd515adee4e5a1Affected
  • be71b5cba2e6485e8959da7a9f9a44461a1bb074 to before c86a2517df6c9304db8fb12b77136ec7a5d85994Affected
  • be71b5cba2e6485e8959da7a9f9a44461a1bb074 to before 721b75ea2dfce53a8890dff92ae01afca8e74f88Affected
  • be71b5cba2e6485e8959da7a9f9a44461a1bb074 to before 3c675ddffb17a8b1e32efad5c983254af18b12c2Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.121 through 5.15.*Not affected
  • 6.1.39 through 6.1.*Not affected
  • 6.4.4 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.