318 lines
17 KiB
JSON
318 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-22081",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-12-29T08:45:45.816Z",
|
|
"datePublished": "2025-04-16T14:12:30.850Z",
|
|
"dateUpdated": "2026-08-05T11:56:36.719Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:56:36.719Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix a couple integer overflows on 32bit systems\n\nOn 32bit systems the \"off + sizeof(struct NTFS_DE)\" addition can\nhave an integer wrapping issue. Fix it by using size_add()."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable parser only runs against on-disk NTFS metadata, so the attacker must get a crafted image mounted locally (attacker-supplied removable media auto-mounted by udisks2/autofs, a loop-mounted image, or a privileged container) and then reach `hdr_find_e()` with a local `stat()`/`open()` on a path inside the malicious directory. No remote peer or network protocol touches this code.\nAC:L - The wrap is deterministic and fully attacker-authored: setting `de_off` to `0xFFFFFFF0` in the crafted index root defeats both `index_hdr_check()` and `hdr_find_e()`'s gate every time, and the resulting `offs[0] = 0xFFF0` entry is reached by the very first binary-search step. No race, no timing window, and the 32-bit kernel is a property of the targeted deployment (i686 distros, ARM32 embedded/industrial, 32-bit Android) rather than a condition the attacker must win.\nPR:L - Mounting `ntfs3` nominally needs `CAP_SYS_ADMIN` (no `FS_USERNS_MOUNT`), but on desktop, kiosk and shared-workstation deployments an ordinary logged-in user gets attacker-supplied media mounted for them by udisks2/polkit, and every step that actually drives the bug — the path lookup, the file write that triggers `ni_update_parent()` — is an unprivileged file operation. Scoring the lower-privilege reachable path.\nUI:N - No second user has to act: the automounter mounts the attacker's own device without any victim interaction, and the attacker then performs the triggering `stat()`, `ftruncate()` and writeback themselves. In the loop-mount and privileged-container variants the attacker likewise performs the mount directly.\nS:U - The out-of-bounds reads and the `indx_update_dup()` write all land in kernel slab memory and stay within the kernel's own security authority — no hypervisor, IOMMU, or container/VM boundary is crossed.\nC:H - `Add2Ptr(hdr, offs[mid_idx])` yields a pointer 65520 bytes past a 1 KB MFT record or 4 KB index buffer, and that OOB memory is then interpreted as a directory entry — its `ref` field is passed to `ntfs_iget5()`, and `cmp_fnames()` compares its name bytes against the attacker's lookup string, giving a repeatable oracle that lets the attacker read back adjacent kernel heap contents byte by byte.\nI:H - The out-of-bounds entry pointer returned by `hdr_find_e()` flows into `indx_update_dup()`, whose `memcpy(&e_fname->dup, dup, sizeof(*dup))` performs a 0x38-byte heap write ~64 KB out of bounds with content the attacker chooses (`data_size`/`alloc_size` via `ftruncate`, four timestamps via `utimensat`) — a controlled OOB write suitable for corrupting adjacent slab objects and hijacking control flow.\nA:H - A read 65520 bytes past a small kmalloc allocation reliably faults on unmapped memory or trips KASAN/KFENCE, and the `WARN_ON(!e)` in `indx_insert_into_root()` fires on the same corrupted pointer, so a single `stat()` on the crafted mount oopses or panics the kernel."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ntfs3/index.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "0922d86a7a6032cb1694eab0b44b861bd33ba8d5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "1a14e9718a19d2e88de004a1360bfd7a86ed1395",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "0dfe700fbd3525f30a36ffbe390a5b9319bd009a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "284c9549386e9883855fb82b730303bb2edea9de",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "0538f52410b619737e663167b6a2b2d0bc1a589d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "4d0f4f42922a832388a0c2fe5204c0a1037ff786",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
|
|
"lessThan": "5ad414f4df2294b28836b5b7b69787659d6aa708",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/ntfs3/index.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.180",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.134",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.87",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.23",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.11",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14.2",
|
|
"lessThanOrEqual": "6.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "5.15.180"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.1.134"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.6.87"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.12.23"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.13.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.14.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.15"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0922d86a7a6032cb1694eab0b44b861bd33ba8d5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1a14e9718a19d2e88de004a1360bfd7a86ed1395"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0dfe700fbd3525f30a36ffbe390a5b9319bd009a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/284c9549386e9883855fb82b730303bb2edea9de"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0538f52410b619737e663167b6a2b2d0bc1a589d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4d0f4f42922a832388a0c2fe5204c0a1037ff786"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5ad414f4df2294b28836b5b7b69787659d6aa708"
|
|
}
|
|
],
|
|
"title": "fs/ntfs3: Fix a couple integer overflows on 32bit systems",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"cweId": "CWE-190",
|
|
"lang": "en",
|
|
"description": "CWE-190 Integer Overflow or Wraparound"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 5.5,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "MEDIUM",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"integrityImpact": "NONE",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "NONE"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2025-10-01T16:15:26.291199Z",
|
|
"id": "CVE-2025-22081",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-10-01T16:15:28.849Z"
|
|
}
|
|
},
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T19:42:00.625Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |