Security readout for executives and security teams
Plain-English summary
A malformed NTFS filesystem can trigger a use-after-free memory error in the Linux kernel when mounted with the ntfs3 driver. Because the failure occurs inside the kernel, successful triggering could crash the system or compromise data confidentiality and integrity. Risk is concentrated on systems that mount untrusted NTFS media or disk images.
Executive priority
Treat this as a high patching priority for systems that mount removable media, externally supplied disk images, or other untrusted NTFS content. Systems without ntfs3 exposure or with tightly controlled mounting have lower immediate risk, but should still receive the vendor-supported corrected kernel during normal security maintenance.
Technical view
The ntfs3 driver insufficiently validated the $SDH and $SII index roots while initializing NTFS security metadata. Invalid index structures could cause a use-after-free in hdr_find_e during the mount path. The stable fixes add index-root sanity checks. The supplied CVSS 3.1 score is 7.8, with local access, low complexity, user interaction, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure requires a Linux system using ntfs3 to mount a malformed NTFS filesystem. The bundle identifies Linux 5.15 and early 6.x release boundaries, including 5.15.87, 6.0.17, 6.1.3, and 6.2. Distribution backports may alter exposure, so installed package status must be confirmed with the distributor.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. Triggering is associated with mounting crafted NTFS content and requires user interaction under the supplied CVSS vector. Real-world feasibility beyond the documented KASAN crash is not established by these sources.
Researcher notes
The evidence demonstrates a KASAN-detected use-after-free during NTFS mount processing. The correction validates security index roots before use. Exact distribution exposure, exploitability beyond memory corruption, and active exploitation are not established. Compare vendor backports against the four cited stable commits rather than relying solely on the displayed upstream version boundaries.
Mitigation direction
- Install a distribution kernel incorporating the applicable cited stable fix, then reboot into it.
- Confirm the vendor's advisory and backport status for the exact kernel package and branch.
- Until updated, prevent untrusted NTFS media or disk images from being mounted.
- Restrict NTFS mounting workflows to trusted, administratively controlled sources where feasible.
Validation and detection
- Inventory running kernel versions and systems that use ntfs3 or accept NTFS content.
- Verify the installed kernel changelog maps to an applicable cited stable fix.
- Confirm the corrected kernel is running after reboot, not merely installed.
- Review kernel logs for crashes involving hdr_find_e, indx_find, or ntfs_security_init.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50737 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d7ce7bb6881aae186e50f57eea935cff8d504751CVE reference, Linux
- https://git.kernel.org/stable/c/24ee53c6bce15500db22f2a7aee9dd830e806c90CVE reference, Linux
- https://git.kernel.org/stable/c/d6379ce242960a8e9ecd6ff76f476d9336c21f16CVE reference, Linux
- https://git.kernel.org/stable/c/bfcdbae0523bd95eb75a739ffb6221a37109881eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.