PT-2021-5785 · Ntfs-3G+7 · Ntfs-3G+7

Published 2021-08-20 · Updated 2023-01-13 · CVE-2021-33287

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22

Description A heap buffer overflow can occur when specially crafted NTFS attributes are read in the function ntfs attr pread i(), allowing for writing to arbitrary memory or denial of service of the application. This issue may enable an attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 2021.8.22, update to version 2021.8.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the ntfs attr pread i() function until a patch is available.

Fix

DoS

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

ALSA-2022:1759

ALT-PU-2021-2673

ALT-PU-2021-2730

ALT-PU-2021-2767

ALT-PU-2022-2244

AZL-6750

BDU:2022-00237

CESA-2022_1759

CVE-2021-33287

DLA-2819-1

DSA-4971-1

GHSA-Q759-8J5V-Q5JP

MGASA-2022-0001

OESA-2021-1365

OPENSUSE-SU-2021:1244-1

OPENSUSE-SU-2021:2971-1

OPENSUSE-SU-2021_1244-1

OPENSUSE-SU-2021_2971-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2022:1759

RHSA-2022_1759

RLSA-2022:1759

SUSE-SU-2021:2965-1

SUSE-SU-2021:2971-1

USN-5060-1

USN-5060-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Ntfs-3G

Red Hat

Rocky Linux

Suse

References · 252

• https://osv.dev/vulnerability/DSA-4971-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39257 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2965-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39255 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0001 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6750 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5060-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5060-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2819-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00237 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-33287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39263 · Security Note