PT-2021-5778 · Ntfs-3G+7 · Ntfs-3G+7

Published 2021-08-17 · Updated 2023-01-13 · CVE-2021-39257

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22

Description The issue is related to the ntfs attr pwrite function in the NTFS-3G file system driver, which is affected by uncontrolled recursion. This can be exploited by an attacker using a specially crafted NTFS image, potentially leading to a denial of service. A crafted NTFS image with an unallocated bitmap can cause an endless recursive function call chain, starting from ntfs attr pwrite, resulting in stack consumption.

Recommendations For versions prior to 2021.8.22, update to version 2021.8.22 or later to resolve the issue. As a temporary workaround, consider avoiding the use of NTFS images with unallocated bitmaps to minimize the risk of exploitation.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALSA-2022:1759

ALT-PU-2021-2673

ALT-PU-2021-2730

ALT-PU-2021-2767

ALT-PU-2022-2244

AZL-6762

BDU:2022-00228

CESA-2022_1759

CVE-2021-39257

DLA-2819-1

DSA-4971-1

GHSA-Q759-8J5V-Q5JP

MGASA-2022-0001

OESA-2021-1365

OPENSUSE-SU-2021:1244-1

OPENSUSE-SU-2021:2971-1

OPENSUSE-SU-2021_1244-1

OPENSUSE-SU-2021_2971-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2022:1759

RHSA-2022_1759

RLSA-2022:1759

SUSE-SU-2021:2965-1

SUSE-SU-2021:2971-1

USN-5060-1

USN-5060-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Ntfs-3G

Red Hat

Rocky Linux

Suse

References · 248

• https://osv.dev/vulnerability/DSA-4971-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39257 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2965-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39255 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39257 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5060-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5060-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2819-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39263 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/J6ACAL2OSY4MFKIQMETQG4T7ZJS2BVPE · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0001.html · Security Note