CVE-2023-53328

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: Enhance sanity check while generating attr_list<br /> <br /> ni_create_attr_list uses WARN_ON to catch error cases while generating<br /> attribute list, which only prints out stack trace and may not be enough.<br /> This repalces them with more proper error handling flow.<br /> <br /> [ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e<br /> [ 59.673268] #PF: supervisor read access in kernel mode<br /> [ 59.678354] #PF: error_code(0x0000) - not-present page<br /> [ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0<br /> [ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI<br /> [ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4<br /> [ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014<br /> [ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860<br /> [ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8<br /> [ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282<br /> [ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe<br /> [ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0<br /> [ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9<br /> [ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180<br /> [ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050<br /> [ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000<br /> [ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0<br /> [ 59.787607] Call Trace:<br /> [ 59.790271] <br /> [ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10<br /> [ 59.797235] ? kernel_text_address+0xd3/0xe0<br /> [ 59.800856] ? unwind_get_return_address+0x3e/0x60<br /> [ 59.805101] ? __kasan_check_write+0x18/0x20<br /> [ 59.809296] ? preempt_count_sub+0x1c/0xd0<br /> [ 59.813421] ni_ins_attr_ext+0x52c/0x5c0<br /> [ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10<br /> [ 59.821926] ? __vfs_setxattr+0x121/0x170<br /> [ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300<br /> [ 59.829562] ? __vfs_setxattr_locked+0x145/0x170<br /> [ 59.833987] ? vfs_setxattr+0x137/0x2a0<br /> [ 59.836732] ? do_setxattr+0xce/0x150<br /> [ 59.839807] ? setxattr+0x126/0x140<br /> [ 59.842353] ? path_setxattr+0x164/0x180<br /> [ 59.845275] ? __x64_sys_setxattr+0x71/0x90<br /> [ 59.848838] ? do_syscall_64+0x3f/0x90<br /> [ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc<br /> [ 59.857046] ? stack_depot_save+0x17/0x20<br /> [ 59.860299] ni_insert_attr+0x1ba/0x420<br /> [ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10<br /> [ 59.867069] ? preempt_count_sub+0x1c/0xd0<br /> [ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50<br /> [ 59.874088] ? __create_object+0x3ae/0x5d0<br /> [ 59.877865] ni_insert_resident+0xc4/0x1c0<br /> [ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10<br /> [ 59.886355] ? kasan_save_alloc_info+0x1f/0x30<br /> [ 59.891117] ? __kasan_kmalloc+0x8b/0xa0<br /> [ 59.894383] ntfs_set_ea+0x90d/0xbf0<br /> [ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10<br /> [ 59.901011] ? kernel_text_address+0xd3/0xe0<br /> [ 59.905308] ? __kernel_text_address+0x16/0x50<br /> [ 59.909811] ? unwind_get_return_address+0x3e/0x60<br /> [ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10<br /> [ 59.920250] ? arch_stack_walk+0xa2/0x100<br /> [ 59.924560] ? filter_irq_stacks+0x27/0x80<br /> [ 59.928722] ntfs_setxattr+0x405/0x440<br /> [ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10<br /> [ 59.936634] ? kvmalloc_node+0x2d/0x120<br /> [ 59.940378] ? kasan_save_stack+0x41/0x60<br /> [ 59.943870] ? kasan_save_stack+0x2a/0x60<br /> [ 59.947719] ? kasan_set_track+0x29/0x40<br /> [ 59.951417] ? kasan_save_alloc_info+0x1f/0x30<br /> [ 59.955733] ? __kasan_kmalloc+0x8b/0xa0<br /> [ 59.959598] ? __kmalloc_node+0x68/0x150<br /> [ 59.963163] ? kvmalloc_node+0x2d/0x120<br /> [ 59.966490] ? vmemdup_user+0x2b/0xa0<br /> ---truncated---