PT-2021-5803 · Ntfs-3G+7 · Ntfs-3G+7

Published 2021-08-20 · Updated 2023-01-13 · CVE-2021-35267

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22

Description A stack buffer overflow can occur when correcting differences in the MFT and MFTMirror, allowing for code execution or escalation of privileges when setuid-root. The vulnerability is related to errors when correcting differences in MFT and MFTMirror, which can be exploited to gain access to confidential data, disrupt their integrity, and cause a denial of service.

Recommendations For NTFS-3G versions prior to 2021.8.22, update to version 2021.8.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid-root to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2022:1759

ALT-PU-2021-2673

ALT-PU-2021-2730

ALT-PU-2021-2767

ALT-PU-2022-2244

AZL-6753

BDU:2022-00262

CESA-2022_1759

CVE-2021-35267

DLA-2819-1

DSA-4971-1

GHSA-Q759-8J5V-Q5JP

MGASA-2022-0001

OESA-2021-1365

OPENSUSE-SU-2021:1244-1

OPENSUSE-SU-2021:2971-1

OPENSUSE-SU-2021_1244-1

OPENSUSE-SU-2021_2971-1

RHSA-2021:3703

RHSA-2021:3704

RHSA-2022:1759

RHSA-2022_1759

RLSA-2022:1759

SUSE-SU-2021:2965-1

SUSE-SU-2021:2971-1

USN-5060-1

USN-5060-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Ntfs-3G

Red Hat

Rocky Linux

Suse

References · 250

• https://nvd.nist.gov/vuln/detail/CVE-2021-39254 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39259 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35268 · Security Note
• https://ubuntu.com/security/notices/USN-5060-2 · Vendor Advisory
• https://security.gentoo.org/glsa/202301-01 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33289 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1365 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35269 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2971-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35267 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1759.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39262 · Security Note