{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-54063",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-54063"
  ],
  "published": "2025-12-24T12:27:01Z",
  "summary": "fs/ntfs3: Fix OOB read in indx_insert_into_buffer",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix OOB read in indx_insert_into_buffer\n\nSyzbot reported a OOB read bug:\n\nBUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0\nfs/ntfs3/index.c:1755\nRead of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630\n\nCall Trace:\n <TASK>\n memmove+0x25/0x60 mm/kasan/shadow.c:54\n indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755\n indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863\n ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548\n ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100\n lookup_open fs/namei.c:3413 [inline]\n\nIf the member struct INDEX_BUFFER *index of struct indx_node is\nincorrect, that is, the value of __le32 used is greater than the value\nof __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when\nmemmove is called in indx_insert_into_buffer().\nFix this by adding a check in hdr_find_e().",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.28"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54063"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cd7e1d67924081717c5c96ead758a1a77867689a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/17048287ac79abd33b275ac3b5738285d406481b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a7e5dba10ba1402dd6c2f961a70320770865c4a5"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4bf3b564e27a518f158a83d5e1a50064ed6136a0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b8c44949044e5f7f864525fdffe8e95135ce9ce5"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerability is triggered by mounting a crafted NTFS3 image and then performing an ordinary directory operation (create/mkdir/rename) on it, which is purely local \u2014 syscall/VFS access plus a block device or loop-backed image. No network-facing service parses this data.\nAC:L - The attacker fully authors the on-disk INDEX_ROOT that supplies the oversized `to_move`, so the overflow is deterministic and repeatable with no race, timing window, or uncontrolled memory-layout dependency.\nPR:L - Once the volume is mounted, the vulnerable path (`ntfs_create`/`ntfs_mkdir`/rename \u2192 `indx_insert_entry`) is reachable by any unprivileged user with write access to a directory, and on desktop/kiosk/automotive systems udisks2 or systemd automount lets an ordinary local-session user mount their own crafted NTFS media without additional privilege.\nUI:N - The attacker performs both steps \u2014 supplying/mounting the crafted image via automount and issuing the file-creation syscall \u2014 with no action required from any other user; this matches the established scoring for the sibling ntfs3 crafted-image CVEs.\nS:U - The corruption is confined to kernel slab memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The `memmove()` in `indx_insert_into_buffer()` reads up to ~17 KB of adjacent kernel slab data (heap pointers, other objects) into the index buffer, which `indx_write()` then persists to disk where the attacker can read it back from their own image \u2014 a direct kernel-heap disclosure primitive.\nI:H - `hdr_insert_head()` performs an unchecked `memmove`/`memcpy` past the end of the `kmalloc(1u << index_bits)` index buffer with attacker-controlled length and attacker-authored entry bytes, giving a controllable slab overflow that can overwrite adjacent objects and be leveraged for arbitrary write and control-flow hijack.\nA:H - The out-of-bounds access produced a KASAN slab-out-of-bounds report and, on production kernels, corrupts adjacent slab objects and heap metadata, reliably leading to an oops or panic."
    }
  }
}