CVE-2022-49762

ntfs: check overflow when iterating ATTR_RECORDs

published May 1, 2025

CVSS
—
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ntfs: check overflow when iterating ATTR_RECORDs

Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find().

Because the ATTR_RECORDs are next to each other, kernel can get the next

ATTR_RECORD from end address of current ATTR_RECORD, through current

ATTR_RECORD length field.

The problem is that during iteration, when kernel calculates the end

address of current ATTR_RECORD, kernel may trigger an integer overflow bug

in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`. This

may wrap, leading to a forever iteration on 32bit systems.

This patch solves it by adding some checks on calculating end address

of current ATTR_RECORD during iteration.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Published
2025-05-01T14:09Z
EPSS history
Timeline
  • 01 MAY 14:09Z
    ntfs: check overflow when iterating ATTR_RECORDs
    cvelistv5