Vulnerability-Lookup

GHSA-QX79-Q87H-MHP6

Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2025-05-06 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-22080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-16T15:16:02Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Prevent integer overflow in hdr_first_de()\n\nThe \"de_off\" and \"used\" variables come from the disk so they both need to\ncheck.  The problem is that on 32bit systems if they\u0027re both greater than\nUINT_MAX - 16 then the check does work as intended because of an integer\noverflow.",
  "id": "GHSA-qx79-q87h-mhp6",
  "modified": "2025-05-06T18:30:36Z",
  "published": "2025-04-16T15:34:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22080"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/201a2bdda13b619c4927700ffe47d387a30ced50"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6bb81b94f7a9cba6bde9a905cef52a65317a8b04"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85615aa442830027923fc690390fa74d17b36ae1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9982065b82b4177ba3a7a72ce18c84921f7494d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-22080 (GCVE-0-2025-22080)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-08-05 11:56

Title

fs/ntfs3: Prevent integer overflow in hdr_first_de()

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 16:15 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6666 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/f6d44b1aa46d317e5…
https://git.kernel.org/stable/c/201a2bdda13b619c4…
https://git.kernel.org/stable/c/85615aa4428300279…
https://git.kernel.org/stable/c/b9982065b82b4177b…
https://git.kernel.org/stable/c/6bb81b94f7a9cba6b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 60ce8dfde03558bfc290cd915c60fa243ba2ae84 , < f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0 (git) Affected: 60ce8dfde03558bfc290cd915c60fa243ba2ae84 , < 201a2bdda13b619c4927700ffe47d387a30ced50 (git) Affected: 60ce8dfde03558bfc290cd915c60fa243ba2ae84 , < 85615aa442830027923fc690390fa74d17b36ae1 (git) Affected: 60ce8dfde03558bfc290cd915c60fa243ba2ae84 , < b9982065b82b4177ba3a7a72ce18c84921f7494d (git) Affected: 60ce8dfde03558bfc290cd915c60fa243ba2ae84 , < 6bb81b94f7a9cba6bde9a905cef52a65317a8b04 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.87 , ≤ 6.6.* (semver) Unaffected: 6.12.23 , ≤ 6.12.* (semver) Unaffected: 6.13.11 , ≤ 6.13.* (semver) Unaffected: 6.14.2 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T16:15:41.224860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T16:15:44.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "201a2bdda13b619c4927700ffe47d387a30ced50",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "85615aa442830027923fc690390fa74d17b36ae1",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "b9982065b82b4177ba3a7a72ce18c84921f7494d",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "6bb81b94f7a9cba6bde9a905cef52a65317a8b04",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Prevent integer overflow in hdr_first_de()\n\nThe \"de_off\" and \"used\" variables come from the disk so they both need to\ncheck.  The problem is that on 32bit systems if they\u0027re both greater than\nUINT_MAX - 16 then the check does work as intended because of an integer\noverflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by presenting a crafted NTFS volume to the local kernel as a block device \u2014 a USB stick on an automounting kiosk/NAS/infotainment unit, or a loop/NBD-backed image mounted via udisks2 \u2014 driving mount(2) and the subsequent index walks in fs/ntfs3/index.c. No network protocol handler is involved, and physical access is not strictly required since loop and network-block-backed images work equally well.\nAC:L - Every input to the wrap \u2014 hdr-\u003ede_off, hdr-\u003eused, hdr-\u003etotal, the entry size fields, and the attribute-list layout that steers which header escapes index_hdr_check() \u2014 is an attacker-chosen byte in the image, so the corruption is deterministic with no race to win and no dependency on kernel memory layout the attacker cannot influence. The 32-bit size_t requirement is a property of the target the attacker selects, and ntfs3 automounting removable NTFS media on 32-bit ARM NAS boxes, media players, and embedded appliances is the driver\u0027s canonical deployment rather than a rare configuration.\nPR:N - The attacker needs no account or credential on the target \u2014 they only supply the malicious filesystem image, which is then mounted by root, by an automount daemon such as udisks2/systemd, or by a container/VM image-handling service acting on the attacker\u0027s data. Every privileged operation along the path is performed by the victim system on the attacker\u0027s behalf; where a local account does exist, desktop polkit loop-mount brokering provides the same reach at even lower cost.\nUI:N - On kiosks, NAS appliances, and infotainment systems that automount removable media, inserting the device triggers the mount with no human participation, and the index code runs unattended during mount itself via ntfs_security_init()\u0027s indx_init()/indx_find() on the $SDH/$SII trees rather than waiting for a subsequent file access. In the loop-device scenario the attacker performs the mount themselves, so no separate victim action is required either.\nS:U - The wrapped pointer arithmetic, out-of-bounds reads, and memmove/memcpy writes all occur in kernel heap memory within the same kernel security authority that hosts the vulnerable ntfs3 code. No VM, IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The wrapped pointer makes hdr_first_de() return an NTFS_DE outside the index buffer, and because hdr_next_de()\u0027s bound check wraps identically with used near UINT_MAX, the entry walk proceeds past the allocation reading adjacent kernel heap as entry headers. Those bytes are consumed as file names, key_size, and MFT references and handed to userspace through ntfs_dir_emit()/dir_emit() during readdir, and steer de_get_vbn()-driven follow-on reads, making adjacent kernel memory directly observable.\nI:H - The same out-of-bounds entry pointer is passed to the mutation paths \u2014 hdr_insert_de() performs memmove(Add2Ptr(before, de_size), before, used - off) and memcpy(before, de, de_size) through it, hdr_delete_de() memmoves through it, and indx_delete_entry() applies le16_sub_cpu()/le32_sub_cpu() to fields at that address \u2014 yielding an out-of-bounds write of attacker-chosen bytes into kernel heap adjacent to the MFT-record or index-block allocation. Controlled heap overwrite of that form is a usable memory-corruption primitive for control-flow hijack, and the corrupted headers are additionally written back to disk by indx_write().\nA:H - Dereferencing and walking a pointer built from wrapped 32-bit arithmetic reads and writes past the kmalloc\u0027d index buffer, producing slab corruption and oops/panic (KASAN-class out-of-bounds), and the resulting nonsensical index geometry drives _ntfs_bad_inode()/-EINVAL error paths across the mounted volume. The fault occurs during mount or the first directory operation and can be reproduced on every mount attempt of the crafted image."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:35.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/201a2bdda13b619c4927700ffe47d387a30ced50"
        },
        {
          "url": "https://git.kernel.org/stable/c/85615aa442830027923fc690390fa74d17b36ae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9982065b82b4177ba3a7a72ce18c84921f7494d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bb81b94f7a9cba6bde9a905cef52a65317a8b04"
        }
      ],
      "title": "fs/ntfs3: Prevent integer overflow in hdr_first_de()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22080",
    "datePublished": "2025-04-16T14:12:29.886Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-08-05T11:56:35.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted