Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Debian: DLA-3055-1 Critical: Ntfs-3g Local Escalation Risks

debian lts
Calendar Grey June 21, 2022
Dist Debian Esm H88
A recent patch for ext4 has resolved several vulnerabilities that could lead to unauthorized privilege elevation for local accounts.
Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE
Topics%20covered

Topics Covered

security advisory buffer overflow critical Debian local escalation ntfs-3g

Summary

CVE-2022-30783

An invalid return code in fuse_kern_mount enables intercepting of
libfuse-lite protocol traffic between NTFS-3G and the kernel when
using libfuse-lite.

CVE-2022-30784

A crafted NTFS image can cause heap exhaustion in
ntfs_get_attribute_value.

CVE-2022-30785

A file handle created in fuse_lib_opendir, and later used in
fuse_lib_readdir, enables arbitrary memory read and write
operations when using libfuse-lite.

CVE-2022-30786

A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_names_full_collate.

CVE-2022-30787

An integer underflow in fuse_lib_readdir enables arbitrary memory
read operations when using libfuse-lite.

CVE-2022-30788

A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_mft_rec_alloc.

CVE-2022-30789

A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_check_log_client_array.

For Debian 9 stretch, these problems have been fixed in version
1:2016.2.22AR.1+dfsg-1+deb9u3.

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: ntfs-3g
Version: 1:2016.2.22AR.1+dfsg-1+deb9u3
CVE ID: CVE-2022-30783 CVE-2022-30784 CVE-2022-30785 CVE-2022-30786
Debian Bug: 1011770

Topics%20covered

Topics Covered

security advisory buffer overflow critical Debian local escalation ntfs-3g

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here