PT-2022-5305 · Ntfs-3G+10 · Ntfs-3G+10
Eduardo Vela
+1
·
Published
2022-10-26
·
Updated
2024-06-15
·
CVE-2022-40284
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
NTFS-3G versions prior to 2022.10.3
Description
A buffer overflow was discovered in NTFS-3G, which can be exploited by crafted metadata in an NTFS image, leading to code execution. This can be exploited by a local attacker if the ntfs-3g binary is setuid root, or by a physically proximate attacker if NTFS-3G software is configured to execute upon attachment of an external storage device. The issue is related to errors in processing metadata, allowing an attacker to execute arbitrary code.
Recommendations
For NTFS-3G versions prior to 2022.10.3, update to version 2022.10.3 or later to resolve the issue. As a temporary workaround, consider disabling the execution of NTFS-3G upon attachment of an external storage device and removing setuid root permissions from the ntfs-3g binary to minimize the risk of exploitation. Restrict access to the ntfs-3g utility to prevent potential attacks.
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Ntfs-3G
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu