tOS NTFS Driver — Stack Overflow via Directory Listing
In ntfs_name_decode of ntfs.c, the name_length field is read directly from the on-disk $FILE_NAME attribute of an NTFS directory index entry (a value up to 255, fully controlled by whoever crafts the mounted volume or disk image) and used to copy that many characters into a fixed 128-byte destination buffer with no bounds check. This allows a crafted NTFS volume to overflow a stack-allocated array of directory entries simply by listing the directory (e.g. via the ls shell command), corrupting adjacent stack memory.
After finding the 'clamp exists in one place but isn't enforced everywhere it's used' pattern in the audio decoder in ASI-2026-0005, we continued the search into filesystem drivers. While reviewing the NTFS driver, we found that ntfs_name_decode used a length value read from an on-disk field as a copy count into a fixed-size destination buffer with no validation at all.
The name_length field is read directly from the on-disk $FILE_NAME attribute of an NTFS directory index entry. Per the NTFS format this value can range from 0 to 255 and is fully controlled by whoever crafts the mounted volume. This value was used, with no clamp at all, as the number of characters to copy into a fixed VFS_NAME_LEN (128-byte) destination buffer. Whenever name_length exceeded 128, the copy operation overflowed the destination buffer into adjacent stack memory holding the array of directory entries.
An attacker prepares a malicious NTFS disk image or removable volume containing a $FILE_NAME attribute with name_length set above 128. The victim mounts this disk/image and lists a directory on it (e.g. with ls). During this operation, ntfs_name_decode writes past the bounds of the destination buffer, corrupting adjacent stack-allocated directory-entry data. Exploitation requires physical access (attaching the disk) and listing the directory.
name_length is taken directly from the on-disk directory index entry (0-255 per the NTFS format) and used unclamped as a copy count into a fixed VFS_NAME_LEN (128) destination buffer, with no validation against the destination's actual capacity.
ntfs_name_decode() now takes the destination buffer's capacity and clamps the copy length to it before writing, and the call site passes sizeof() of the actual destination array.
CWE-121, CWE-20
Artfical DT Developer Talha Berk Arslan