CVE-2023-53328 in Linux
الملخص
بحسب VulDB • 26/05/2026
Based on the kernel stack trace provided, here is an analysis of the issue:
### **Summary** This is a **KASAN (Kernel Address Sanitizer)** report indicating a **memory safety violation** (likely a use-after-free, out-of-bounds access, or invalid memory access) occurring within the **NTFS3 filesystem driver** (`ntfs3`) when setting an extended attribute (`setxattr`).
The crash happens in `path_setxattr` → `ntfs_setxattr` → `ntfs_set_ea` → `ni_insert_resident` → `ni_insert_attr` → `path_setxattr`.
---
### **Key Components in the Stack Trace**
1. **`path_setxattr`**: The VFS (Virtual File System) layer function that handles setting extended attributes. 2. **`ntfs_setxattr`**: The NTFS3-specific implementation of `setxattr`. 3. **`ntfs_set_ea`**: Handles the actual Extended Attribute (EA) insertion logic. 4. **`ni_insert_resident`**: Inserts the EA into the resident (on-disk) attribute list. 5. **`ni_insert_attr`**: Low-level function to insert the attribute structure. 6. **`__x64_sys_setxattr`**: The system call entry point.
---
### **Likely Cause** The NTFS3 driver is attempting to modify or insert an extended attribute into a file's resident attribute list, but it encounters an invalid memory state. Common causes in this context include:
1. **Use-After-Free**: The attribute structure or its parent inode was freed before this operation completed. 2. **Out-of-Bounds Access**: The code is reading/writing beyond the allocated buffer for the EA list. 3. **Race Condition**: Concurrent modifications to the same file’s attribute list without proper locking. 4. **Corrupted In-Memory Structure**: The NTFS inode or attribute list metadata is corrupted (possibly due to a previous bug or disk corruption).
---
### **Debugging Steps**
#### 1. **Check for Recent NTFS3 Changes** - This bug may have been introduced in recent kernel versions. Check if you are using a mainline kernel or a distribution-specific kernel. - Look for known issues in the Linux kernel mailing list (LKML) or bug trackers (e.g., kernel.org bugzilla, Red Hat Bugzilla) related to `ntfs3 setxattr`.
#### 2. **Reproduce with Minimal Test Case** - Try to reproduce the issue with a simple script: ```bash # Create a file on an NTFS3 mount touch /mnt/ntfs/testfile # Set an extended attribute setfattr -n user.test -v "data" /mnt/ntfs/testfile ``` - If it crashes consistently, it’s likely a deterministic bug in the EA insertion logic.
#### 3. **Enable More Debugging** - Reboot with kernel parameters to get more details: ``` kasan=on ntfs3.debug=1 ``` - Check `dmesg` for additional KASAN details (e.g., "BUG: KASAN: use-after-free in ...").
#### 4. **Check for Disk Corruption** - Run `ntfsfix` or `chkdsk` on the NTFS partition to rule out on-disk corruption that might lead to invalid in-memory structures.
#### 5. **Update Kernel** - If you are using an older kernel, try updating to the latest stable kernel. Many NTFS3 bugs have been fixed in recent releases.
#### 6. **Workaround** - If possible, avoid setting extended attributes on NTFS3 filesystems until the bug is fixed. - Alternatively, use a different filesystem (e.g., ext4, xfs) for critical data.
---
### **Potential Fix** If you are a kernel developer or can provide this to your distribution maintainer: - The bug is likely in `ni_insert_attr` or `ntfs_set_ea`. - Check for proper bounds checking when inserting attributes into the resident list. - Ensure proper locking (`ni_lock`) is held during the insertion. - Verify that the attribute buffer is correctly allocated and freed.
---
### **Conclusion** This is a **kernel bug in the NTFS3 driver** triggered by setting an extended attribute. It is not a user-space error but a memory safety violation in the kernel. Please report this to your kernel maintainer or the Linux kernel mailing list with the full KASAN output and steps to reproduce.
VulDB is the best source for vulnerability data and more expert information about this specific topic.