CVE-2023-54077 (GCVE-0-2023-54077)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:03 – Updated: 2026-08-05 09:17
VLAI
Title
fs/ntfs3: Fix memory leak if ntfs_read_mft failed
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix memory leak if ntfs_read_mft failed Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC and alloc ni->dir.alloc_run. However two states are not always consistent and can make memory leak. 1) attr_name in ATTR_ROOT does not fit the condition it will set is_root = true but NI_FLAG_DIR is not set. 2) next attr_name in ATTR_ALLOC fits the condition and alloc ni->dir.alloc_run 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees ni->dir.alloc_run, otherwise it frees ni->file.run 4) because NI_FLAG_DIR is not set in this case, ni->dir.alloc_run is leaked as kmemleak reported: unreferenced object 0xffff888003bc5480 (size 64): backtrace: [<000000003d42e6b0>] __kmalloc_node+0x4e/0x1c0 [<00000000d8e19b8a>] kvmalloc_node+0x39/0x1f0 [<00000000fc3eb5b8>] run_add_entry+0x18a/0xa40 [ntfs3] [<0000000011c9f978>] run_unpack+0x75d/0x8e0 [ntfs3] [<00000000e7cf1819>] run_unpack_ex+0xbc/0x500 [ntfs3] [<00000000bbf0a43d>] ntfs_iget5+0xb25/0x2dd0 [ntfs3] [<00000000a6e50693>] ntfs_fill_super+0x218d/0x3580 [ntfs3] [<00000000b9170608>] get_tree_bdev+0x3fb/0x710 [<000000004833798a>] vfs_get_tree+0x8e/0x280 [<000000006e20b8e6>] path_mount+0xf3c/0x1930 [<000000007bf15a5f>] do_mount+0xf3/0x110 ... Fix this by always setting is_root and NI_FLAG_DIR together.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 3030f2b9b3329db3948c1a145a5493ca6f617d50 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 1bc6bb657dfb0ab3b94ef6d477ca241bf7b6ec06 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 93bf79f989688852deade1550fb478b0a4d8daa8 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 3bb0d3eb475f01744ce6d6e998dfbd80220852a1 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < bfa434c60157c9793e9b12c9b68ade02aff9f803 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.111 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3030f2b9b3329db3948c1a145a5493ca6f617d50",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "1bc6bb657dfb0ab3b94ef6d477ca241bf7b6ec06",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "93bf79f989688852deade1550fb478b0a4d8daa8",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "3bb0d3eb475f01744ce6d6e998dfbd80220852a1",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "bfa434c60157c9793e9b12c9b68ade02aff9f803",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix memory leak if ntfs_read_mft failed\n\nLabel ATTR_ROOT in ntfs_read_mft() sets is_root = true and\nni-\u003eni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC\nand alloc ni-\u003edir.alloc_run. However two states are not always\nconsistent and can make memory leak.\n\n 1) attr_name in ATTR_ROOT does not fit the condition it will set\n is_root = true but NI_FLAG_DIR is not set.\n 2) next attr_name in ATTR_ALLOC fits the condition and alloc\n ni-\u003edir.alloc_run\n 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees\n ni-\u003edir.alloc_run, otherwise it frees ni-\u003efile.run\n 4) because NI_FLAG_DIR is not set in this case, ni-\u003edir.alloc_run is\n leaked as kmemleak reported:\n\nunreferenced object 0xffff888003bc5480 (size 64):\n  backtrace:\n    [\u003c000000003d42e6b0\u003e] __kmalloc_node+0x4e/0x1c0\n    [\u003c00000000d8e19b8a\u003e] kvmalloc_node+0x39/0x1f0\n    [\u003c00000000fc3eb5b8\u003e] run_add_entry+0x18a/0xa40 [ntfs3]\n    [\u003c0000000011c9f978\u003e] run_unpack+0x75d/0x8e0 [ntfs3]\n    [\u003c00000000e7cf1819\u003e] run_unpack_ex+0xbc/0x500 [ntfs3]\n    [\u003c00000000bbf0a43d\u003e] ntfs_iget5+0xb25/0x2dd0 [ntfs3]\n    [\u003c00000000a6e50693\u003e] ntfs_fill_super+0x218d/0x3580 [ntfs3]\n    [\u003c00000000b9170608\u003e] get_tree_bdev+0x3fb/0x710\n    [\u003c000000004833798a\u003e] vfs_get_tree+0x8e/0x280\n    [\u003c000000006e20b8e6\u003e] path_mount+0xf3c/0x1930\n    [\u003c000000007bf15a5f\u003e] do_mount+0xf3/0x110\n    ...\n\nFix this by always setting is_root and NI_FLAG_DIR together."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the on-disk MFT record parser, reached via ntfs_fill_super()/ntfs_iget5() when an attacker-supplied NTFS volume is mounted, requiring local presentation of the image (USB stick, loop device, disk image) rather than network access.\nAC:L - The inconsistent is_root/NI_FLAG_DIR state is produced deterministically by attacker-controlled on-disk structures \u2014 an $INDEX_ROOT attribute named other than $I30 (or in a record without RECORD_FLAG_DIR) followed by an $INDEX_ALLOCATION attribute \u2014 with no race and no reliance on memory layout the attacker cannot influence.\nPR:N - The attacker only has to supply the malicious filesystem image and needs no account or privileges on the target system; the mount is performed by the victim or by an automounter such as udisks2.\nUI:R - Exploitation requires someone on the target to mount the crafted NTFS volume, e.g. inserting the attacker\u0027s USB device or opening the supplied image.\nS:U - The corruption and leak are confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Because ni-\u003edir and ni-\u003efile share a union, dir.alloc_run.allocated aliases file.run.runs, leaving the file\u0027s runs_tree with a bogus base pointer and (for the $MFT case) an enormous count, so run_lookup()/run_lookup_entry() perform out-of-bounds reads of kernel memory that influence returned file data.\nI:H - The same union aliasing lets run_add_entry() store r-\u003evcn/lcn/len through the corrupted runs_tree base, and run_close() in ni_clear() calls kvfree() on a non-pointer value, corrupting slab/page-allocator state \u2014 memory corruption leverageable for control-flow hijacking.\nA:H - Every affected inode leaks its kvmalloc\u0027ed run array unboundedly (kmemleak-confirmed), and on default configs the aliased ni-\u003efile.run.runs causes an invalid kvfree()/wild-pointer dereference at inode eviction or unmount, producing a kernel oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:01.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3030f2b9b3329db3948c1a145a5493ca6f617d50"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bc6bb657dfb0ab3b94ef6d477ca241bf7b6ec06"
        },
        {
          "url": "https://git.kernel.org/stable/c/93bf79f989688852deade1550fb478b0a4d8daa8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bb0d3eb475f01744ce6d6e998dfbd80220852a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa434c60157c9793e9b12c9b68ade02aff9f803"
        }
      ],
      "title": "fs/ntfs3: Fix memory leak if ntfs_read_mft failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54077",
    "datePublished": "2025-12-24T13:03:25.790Z",
    "dateReserved": "2025-12-24T12:21:05.094Z",
    "dateUpdated": "2026-08-05T09:17:01.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54077",
      "date": "2026-09-28",
      "epss": "0.00178",
      "percentile": "0.06573"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3030f2b9b3329db3948c1a145a5493ca6f617d50",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1bc6bb657dfb0ab3b94ef6d477ca241bf7b6ec06",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93bf79f989688852deade1550fb478b0a4d8daa8",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3bb0d3eb475f01744ce6d6e998dfbd80220852a1",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfa434c60157c9793e9b12c9b68ade02aff9f803",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix memory leak if ntfs_read_mft failed\n\nLabel ATTR_ROOT in ntfs_read_mft() sets is_root = true and\nni-\u003eni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC\nand alloc ni-\u003edir.alloc_run. However two states are not always\nconsistent and can make memory leak.\n\n 1) attr_name in ATTR_ROOT does not fit the condition it will set\n is_root = true but NI_FLAG_DIR is not set.\n 2) next attr_name in ATTR_ALLOC fits the condition and alloc\n ni-\u003edir.alloc_run\n 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees\n ni-\u003edir.alloc_run, otherwise it frees ni-\u003efile.run\n 4) because NI_FLAG_DIR is not set in this case, ni-\u003edir.alloc_run is\n leaked as kmemleak reported:\n\nunreferenced object 0xffff888003bc5480 (size 64):\n  backtrace:\n    [\u003c000000003d42e6b0\u003e] __kmalloc_node+0x4e/0x1c0\n    [\u003c00000000d8e19b8a\u003e] kvmalloc_node+0x39/0x1f0\n    [\u003c00000000fc3eb5b8\u003e] run_add_entry+0x18a/0xa40 [ntfs3]\n    [\u003c0000000011c9f978\u003e] run_unpack+0x75d/0x8e0 [ntfs3]\n    [\u003c00000000e7cf1819\u003e] run_unpack_ex+0xbc/0x500 [ntfs3]\n    [\u003c00000000bbf0a43d\u003e] ntfs_iget5+0xb25/0x2dd0 [ntfs3]\n    [\u003c00000000a6e50693\u003e] ntfs_fill_super+0x218d/0x3580 [ntfs3]\n    [\u003c00000000b9170608\u003e] get_tree_bdev+0x3fb/0x710\n    [\u003c000000004833798a\u003e] vfs_get_tree+0x8e/0x280\n    [\u003c000000006e20b8e6\u003e] path_mount+0xf3c/0x1930\n    [\u003c000000007bf15a5f\u003e] do_mount+0xf3/0x110\n    ...\n\nFix this by always setting is_root and NI_FLAG_DIR together."
          }
        ],
        "id": "CVE-2023-54077",
        "lastModified": "2026-08-04T10:19:27.853",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:09.543",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1bc6bb657dfb0ab3b94ef6d477ca241bf7b6ec06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3030f2b9b3329db3948c1a145a5493ca6f617d50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3bb0d3eb475f01744ce6d6e998dfbd80220852a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/93bf79f989688852deade1550fb478b0a4d8daa8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfa434c60157c9793e9b12c9b68ade02aff9f803"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T15:10:09+00:00",
      "cve": "CVE-2023-54077",
      "id": "CVE-2023-54077",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: ntfs3 memory leak via inconsistent flag handling leading to denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54077.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-29T02:04:02Z",
      "cve": "CVE-2023-54077",
      "id": "CVE-2023-54077",
      "initial_release_date": "2025-12-25T00:56:11Z",
      "product_status:known_not_affected": "514",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54077",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54077.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.