Linux Kernel NTFS3 Reserved XATTR Direct Write Vulnerability Allows Privilege Escalation

A vulnerability in the Linux kernel's NTFS3 file system implementation allows unprivileged users to write to reserved extended attribute names that are used for internal Windows Subsystem for Linux (WSL) permission metadata. This vulnerability is present in the Linux kernel NTFS3 component, specifically through a combination of the empty-prefix extended attribute handler and writable NTFS3 mounts. When a file owner writes to these reserved attributes, it can result in planting root ownership and the set-user-ID (S_ISUID) attribute on their own files. After the inode is reloaded, this manipulation grants them elevated privileges, effectively allowing them to execute commands as the root user.

Impact

Exploitation of this vulnerability can lead to unauthorized privilege escalation, allowing a user to gain root access on the system.

Reproduction

To reproduce this vulnerability, an unprivileged user must write to the reserved $LXUID, $LXGID, $LXMOD, or $LXDEV extended attributes on a writable NTFS3 mount. This can be done using the setxattr() function, which is available to file owners. Once the attributes are set, the file's inode must be reloaded, which will apply the changes and grant root privileges (euid 0) to the user.

Remediation

The vulnerability has been addressed in the Linux kernel by rejecting direct user writes to the reserved $LX extended attributes. Users should update to the latest version of the Linux kernel where this fix has been applied.