CVE-2023-26607: Linux Kernel Buffer Overflow Vulnerability

CVE-2023-26607 Overview

CVE-2023-26607 is an out-of-bounds read vulnerability in the Linux kernel 6.0.8, located in the ntfs_attr_find function within fs/ntfs/attrib.c. The flaw allows a local attacker with low privileges to read kernel memory outside intended bounds when the NTFS driver processes a crafted filesystem. The issue is classified under [CWE-125] (Out-of-bounds Read) and affects systems that mount untrusted NTFS volumes. NetApp HCI Baseboard Management Controller products also inherit this exposure through their kernel components.

Critical Impact
A local attacker can trigger out-of-bounds memory reads in the kernel by mounting a malformed NTFS image, leading to information disclosure or kernel denial of service.

Affected Products

Linux kernel 6.0.8 (NTFS filesystem driver in fs/ntfs/attrib.c)
NetApp HCI Baseboard Management Controller (H300S, H410C, H410S, H500S, H700S)
Distributions shipping the affected kernel revision prior to upstream fix 36a4d82

Discovery Timeline

2023-02-26 - CVE-2023-26607 published to NVD
2023-03-16 - NetApp Security Advisory NTAP-20230316-0010 released
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2023-26607

Vulnerability Analysis

The vulnerability resides in the ntfs_attr_find routine, which iterates through NTFS attribute records within a Master File Table (MFT) entry. When parsing attributes, the function fails to validate that attribute offsets and lengths remain within the bounds of the MFT record. A crafted NTFS image can declare attribute sizes that extend beyond the allocated buffer, causing the kernel to read adjacent memory.

The out-of-bounds read occurs during attribute traversal in the read-only NTFS driver (fs/ntfs), which is distinct from the newer ntfs3 driver. Exposure requires the legacy NTFS module to be loaded and used to parse the attacker-supplied image. The upstream fix is captured in commit 36a4d82dddbbd421d2b8e79e1cab68c8126d5075.

Root Cause

The root cause is missing bounds checking on attribute record length and offset fields before they are dereferenced. The function trusts on-disk metadata without verifying that the computed pointer remains inside the MFT record buffer. This is a classic input validation failure on untrusted filesystem structures.

Attack Vector

Exploitation requires local access and the ability to mount or read a crafted NTFS image. On systems where unprivileged users can attach removable media or USB devices, automatic filesystem probing can trigger the vulnerable code path. The impact is information disclosure of kernel memory and potential kernel panic, with no integrity impact according to the CVSS vector.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the LKML Discussion Post for the original report.

Detection Methods for CVE-2023-26607

Indicators of Compromise

Kernel log entries referencing ntfs_attr_find or NTFS parsing errors, including attempt to access beyond end of device or general protection faults in the NTFS module
Unexpected loading of the ntfs kernel module on systems that do not normally mount NTFS volumes
Mount attempts of NTFS images from removable media or user-writable directories by non-administrative accounts

Detection Strategies

Audit dmesg and /var/log/kern.log for NTFS-related warnings, oops messages, or KASAN reports referencing fs/ntfs/attrib.c
Monitor mount syscalls invoking the ntfs filesystem type, especially originating from non-root users or automounters
Enable KASAN (Kernel Address Sanitizer) in test environments to surface out-of-bounds reads during NTFS parsing

Monitoring Recommendations

Track kernel module loads for ntfs.ko using auditd rules on init_module and finit_module syscalls
Alert on repeated kernel oops or BUG reports from filesystem drivers across the fleet
Inventory hosts running Linux kernel 6.0.8 and prioritize patch validation

How to Mitigate CVE-2023-26607

Immediate Actions Required

Upgrade to a Linux kernel version containing commit 36a4d82dddbbd421d2b8e79e1cab68c8126d5075 or a distribution-supplied backport
Apply NetApp updates per NetApp Security Advisory NTAP-20230316-0010 for affected HCI Baseboard Management Controllers
Restrict the ability of unprivileged users to mount NTFS filesystems on production hosts

Patch Information

The upstream fix is available in the Linux kernel git tree as commit 36a4d82. Distribution-specific tracking is available in the SUSE Bug Report #1208703. NetApp customers should consult NetApp Security Advisory NTAP-20230316-0010 for product-specific guidance.

Workarounds

Blacklist the legacy ntfs kernel module on systems that do not require read-only NTFS support
Disable automatic mounting of removable media via udisks or systemd-mount policies
Use the maintained ntfs3 driver where NTFS access is required, as the flaw is specific to the legacy fs/ntfs driver

bash

# Blacklist the legacy NTFS module to remove the vulnerable code path
echo "blacklist ntfs" | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep -w ntfs