PT-2021-5770 · Ntfs-3G+7 · Ntfs-3G+7

Published 2021-08-20 · Updated 2023-01-13 · CVE-2021-35268

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22

Description The issue is related to a heap buffer overflow in the ntfs inode real open function of the NTFS-3G file system driver. This can allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability can be exploited when a specially crafted NTFS inode is loaded, potentially leading to code execution and privilege escalation.

Recommendations For versions prior to 2021.8.22, update to version 2021.8.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the ntfs inode real open function to minimize the risk of exploitation.

Fix

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

ALSA-2022:1759

ALT-PU-2021-2673

ALT-PU-2021-2730

ALT-PU-2021-2767

ALT-PU-2022-2244

AZL-6754

BDU:2022-00219

CESA-2022_1759

CVE-2021-35268

DLA-2819-1

DSA-4971-1

GHSA-Q759-8J5V-Q5JP

MGASA-2022-0001

OESA-2021-1365

OPENSUSE-SU-2021:1244-1

OPENSUSE-SU-2021:2971-1

OPENSUSE-SU-2021_1244-1

OPENSUSE-SU-2021_2971-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2022:1759

RHSA-2022_1759

RLSA-2022:1759

SUSE-SU-2021:2965-1

SUSE-SU-2021:2971-1

USN-5060-1

USN-5060-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Ntfs-3G

Red Hat

Rocky Linux

Suse

References · 251

• https://osv.dev/vulnerability/DSA-4971-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39253 · Security Note
• https://ubuntu.com/security/CVE-2021-35268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39257 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2965-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39255 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35268 · Security Note
• http://ntfs-3g.com · Vendor Advisory
• https://osv.dev/vulnerability/USN-5060-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5060-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2819-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39263 · Security Note