CVE-2023-54063 (GCVE-0-2023-54063)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:23 – Updated: 2026-08-05 09:16
VLAI
Title
fs/ntfs3: Fix OOB read in indx_insert_into_buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix OOB read in indx_insert_into_buffer Syzbot reported a OOB read bug: BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630 Call Trace: <TASK> memmove+0x25/0x60 mm/kasan/shadow.c:54 indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 lookup_open fs/namei.c:3413 [inline] If the member struct INDEX_BUFFER *index of struct indx_node is incorrect, that is, the value of __le32 used is greater than the value of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when memmove is called in indx_insert_into_buffer(). Fix this by adding a check in hdr_find_e().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < cd7e1d67924081717c5c96ead758a1a77867689a (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 17048287ac79abd33b275ac3b5738285d406481b (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < a7e5dba10ba1402dd6c2f961a70320770865c4a5 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 4bf3b564e27a518f158a83d5e1a50064ed6136a0 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < b8c44949044e5f7f864525fdffe8e95135ce9ce5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.111 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd7e1d67924081717c5c96ead758a1a77867689a",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "17048287ac79abd33b275ac3b5738285d406481b",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "a7e5dba10ba1402dd6c2f961a70320770865c4a5",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "4bf3b564e27a518f158a83d5e1a50064ed6136a0",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "b8c44949044e5f7f864525fdffe8e95135ce9ce5",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix OOB read in indx_insert_into_buffer\n\nSyzbot reported a OOB read bug:\n\nBUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0\nfs/ntfs3/index.c:1755\nRead of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630\n\nCall Trace:\n \u003cTASK\u003e\n memmove+0x25/0x60 mm/kasan/shadow.c:54\n indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755\n indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863\n ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548\n ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100\n lookup_open fs/namei.c:3413 [inline]\n\nIf the member struct INDEX_BUFFER *index of struct indx_node is\nincorrect, that is, the value of __le32 used is greater than the value\nof __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when\nmemmove is called in indx_insert_into_buffer().\nFix this by adding a check in hdr_find_e()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by mounting a crafted NTFS3 image and then performing an ordinary directory operation (create/mkdir/rename) on it, which is purely local \u2014 syscall/VFS access plus a block device or loop-backed image. No network-facing service parses this data.\nAC:L - The attacker fully authors the on-disk INDEX_ROOT that supplies the oversized `to_move`, so the overflow is deterministic and repeatable with no race, timing window, or uncontrolled memory-layout dependency.\nPR:L - Once the volume is mounted, the vulnerable path (`ntfs_create`/`ntfs_mkdir`/rename \u2192 `indx_insert_entry`) is reachable by any unprivileged user with write access to a directory, and on desktop/kiosk/automotive systems udisks2 or systemd automount lets an ordinary local-session user mount their own crafted NTFS media without additional privilege.\nUI:N - The attacker performs both steps \u2014 supplying/mounting the crafted image via automount and issuing the file-creation syscall \u2014 with no action required from any other user; this matches the established scoring for the sibling ntfs3 crafted-image CVEs.\nS:U - The corruption is confined to kernel slab memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The `memmove()` in `indx_insert_into_buffer()` reads up to ~17 KB of adjacent kernel slab data (heap pointers, other objects) into the index buffer, which `indx_write()` then persists to disk where the attacker can read it back from their own image \u2014 a direct kernel-heap disclosure primitive.\nI:H - `hdr_insert_head()` performs an unchecked `memmove`/`memcpy` past the end of the `kmalloc(1u \u003c\u003c index_bits)` index buffer with attacker-controlled length and attacker-authored entry bytes, giving a controllable slab overflow that can overwrite adjacent objects and be leveraged for arbitrary write and control-flow hijack.\nA:H - The out-of-bounds access produced a KASAN slab-out-of-bounds report and, on production kernels, corrupts adjacent slab objects and heap metadata, reliably leading to an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:51.916Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd7e1d67924081717c5c96ead758a1a77867689a"
        },
        {
          "url": "https://git.kernel.org/stable/c/17048287ac79abd33b275ac3b5738285d406481b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7e5dba10ba1402dd6c2f961a70320770865c4a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf3b564e27a518f158a83d5e1a50064ed6136a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8c44949044e5f7f864525fdffe8e95135ce9ce5"
        }
      ],
      "title": "fs/ntfs3: Fix OOB read in indx_insert_into_buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54063",
    "datePublished": "2025-12-24T12:23:09.346Z",
    "dateReserved": "2025-12-24T12:21:05.092Z",
    "dateUpdated": "2026-08-05T09:16:51.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54063",
      "date": "2026-09-27",
      "epss": "0.00194",
      "percentile": "0.0815"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/index.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cd7e1d67924081717c5c96ead758a1a77867689a",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "17048287ac79abd33b275ac3b5738285d406481b",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7e5dba10ba1402dd6c2f961a70320770865c4a5",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bf3b564e27a518f158a83d5e1a50064ed6136a0",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8c44949044e5f7f864525fdffe8e95135ce9ce5",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/index.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix OOB read in indx_insert_into_buffer\n\nSyzbot reported a OOB read bug:\n\nBUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0\nfs/ntfs3/index.c:1755\nRead of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630\n\nCall Trace:\n \u003cTASK\u003e\n memmove+0x25/0x60 mm/kasan/shadow.c:54\n indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755\n indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863\n ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548\n ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100\n lookup_open fs/namei.c:3413 [inline]\n\nIf the member struct INDEX_BUFFER *index of struct indx_node is\nincorrect, that is, the value of __le32 used is greater than the value\nof __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when\nmemmove is called in indx_insert_into_buffer().\nFix this by adding a check in hdr_find_e()."
          }
        ],
        "id": "CVE-2023-54063",
        "lastModified": "2026-08-04T10:19:26.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:08.117",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17048287ac79abd33b275ac3b5738285d406481b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bf3b564e27a518f158a83d5e1a50064ed6136a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7e5dba10ba1402dd6c2f961a70320770865c4a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b8c44949044e5f7f864525fdffe8e95135ce9ce5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd7e1d67924081717c5c96ead758a1a77867689a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T12:43:10+00:00",
      "cve": "CVE-2023-54063",
      "id": "CVE-2023-54063",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Out-of-bounds read in NTFS3 filesystem driver",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54063.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:46:27Z",
      "cve": "CVE-2023-54063",
      "id": "CVE-2023-54063",
      "initial_release_date": "2025-12-25T00:56:31Z",
      "product_status:known_not_affected": "560",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54063",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54063.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.