Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 before 83f396d881c4fd312c7fd5fff2c157fc21104464; affected 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 before d97a36bae86a9a4021562ded2987f904e6bcb1d7 |
| Linux / Linux | affected 7.1; unaffected 0 before 7.1; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.