CVE-2024-38623

The ntfs_set_label() function used a fixed size array to store the NTFS volume label name. Attempting to copy data of up to 256 bytes into a buffer of only 20 bytes caused a smatch tool warning about an insufficiently sized destination buffer for the __builtin_memcpy() operation. The fix replaces the fixed-size array with a variable length array, eliminating potential buffer overflow.

An attacker or malicious NTFS file system can cause a buffer overflow in kernel space, which may lead to unauthorized read or write of data, memory corruption, and consequently system destabilization or takeover.

Patches available from the vendor should be applied according to the references — patches have been published in the Linux kernel stable repository at the addresses indicated in the references section. It is recommended to update to the patched kernel version as soon as possible, especially on systems mounting external NTFS volumes.

Linux kernel with enabled NTFS3 file system driver (ntfs3); specific versions indicated in vendor references (patches available at addresses in git.kernel.org references).