CVE-2024-27407: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-27407 Overview

CVE-2024-27407 is a buffer overflow vulnerability in the Linux kernel's NTFS3 filesystem driver. The flaw resides in the mi_enum_attr() function within fs/ntfs3, where an insufficient overflow check allowed out-of-bounds memory access when parsing NTFS attribute records. A local attacker who can trigger mounting or reading a crafted NTFS filesystem image can exploit the flaw to corrupt kernel memory. The vulnerability is tracked under CWE-120 (Buffer Copy without Checking Size of Input) and affects Linux kernel 6.8 release candidates along with earlier stable branches.

Critical Impact
Successful exploitation can lead to kernel memory corruption, resulting in full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

Linux kernel stable branches prior to the patched commits
Linux kernel 6.8-rc1, 6.8-rc2, 6.8-rc3
Debian LTS distributions shipping the NTFS3 driver

Discovery Timeline

2024-05-17 - CVE-2024-27407 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-27407

Vulnerability Analysis

The NTFS3 driver parses on-disk MFT (Master File Table) records through the mi_enum_attr() helper. This function walks through attribute headers stored inside an MFT record and returns pointers to each attribute for the caller to process. Before the fix, the overflow check that validates whether the next attribute header fits within the record boundary was incorrect. An attacker who crafts an NTFS image with malformed attribute offset or length fields can trick the parser into reading past the record buffer.

Once the buffer boundary is crossed, subsequent operations on the returned attribute pointer dereference adjacent kernel memory. Given the local attack vector and the requirement of user interaction, exploitation typically involves inducing a user to mount an attacker-supplied filesystem image or a USB device containing a malicious NTFS volume.

Root Cause

The root cause is an arithmetic boundary miscalculation inside mi_enum_attr(). The original check did not correctly account for the sum of the current offset and the attribute size relative to the total record length, allowing integer wraparound or an off-by-one condition. The upstream fix, applied across multiple stable branches via commits 1c0a95d9, 652cfeb4, 8c77398c, and e99faa97, tightens the bounds validation to reject attribute descriptors that would extend beyond the record.

Attack Vector

Exploitation requires local access and user interaction. An attacker prepares an NTFS filesystem image containing malformed MFT attribute metadata. When a victim mounts the image, whether from a removable device, a disk image file, or an automatic mount daemon, the kernel invokes mi_enum_attr() during metadata parsing and triggers the overflow. Consequences include kernel panic (denial of service), information disclosure of adjacent memory, and potentially privilege escalation through controlled memory corruption.

See the upstream patch commit for the corrected boundary check implementation.

Detection Methods for CVE-2024-27407

Indicators of Compromise

Unexpected kernel oops or panic messages referencing mi_enum_attr or ntfs3 in dmesg and /var/log/kern.log
Mount attempts of NTFS images from untrusted removable media or downloaded disk image files
Processes crashing while accessing NTFS-mounted volumes, followed by filesystem remount errors

Detection Strategies

Monitor kernel ring buffer for KASAN, slab-out-of-bounds, or general protection fault reports tied to the NTFS3 module
Audit mount syscall telemetry for NTFS filesystem mounts originating from non-administrative users or automount services
Correlate USB device insertion events with subsequent kernel module load events for ntfs3

Monitoring Recommendations

Enable auditd rules for mount and umount syscalls to capture filesystem attach events with the source device path
Deploy kernel address sanitizer (KASAN) on test systems to catch out-of-bounds reads during NTFS parsing
Track kernel package versions across fleet inventory to identify hosts still running vulnerable builds

How to Mitigate CVE-2024-27407

Immediate Actions Required

Update the Linux kernel to a version containing the fix commits 1c0a95d9, 652cfeb4, 8c77398c, or e99faa97 from your distribution's stable branch
Apply the Debian LTS security update on Debian systems
Reboot affected systems after patch installation to load the corrected kernel image

Patch Information

The upstream Linux kernel maintainers merged the fix across multiple stable trees. Reference commits are available at kernel.org 1c0a95d9, 652cfeb4, 8c77398c, and e99faa97. Downstream distribution builds should be verified against these commit hashes.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not require NTFS read/write support using modprobe.d configuration
Restrict mounting of removable filesystems by non-root users through polkit rules or udisks2 policy overrides
Disable automount daemons that automatically process inserted USB storage devices in high-risk environments

bash

# Blacklist the ntfs3 module until the patched kernel is deployed
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u

# Verify the running kernel version includes the fix
uname -r
dpkg -l | grep linux-image