Ubuntu 22.04 LTS: USN-5463-1 Critical: NTFS-3G Remote Code Execution

ubuntu

June 7, 2022

Several security issues were fixed in ntfs-3g.

Summary

Several security issues were fixed in ntfs-3g.

Software Description:

- ntfs-3g: read/write NTFS driver for FUSE

Details:

It was discovered that NTFS-3G incorrectly handled the ntfsck tool. If a

user or automated system were tricked into using ntfsck on a specially

crafted disk image, a remote attacker could possibly use this issue to

execute arbitrary code. (CVE-2021-46790)

Roman Fiedler discovered that NTFS-3G incorrectly handled certain return

codes. A local attacker could possibly use this issue to intercept

protocol traffic between FUSE and the kernel. (CVE-2022-30783)

It was discovered that NTFS-3G incorrectly handled certain NTFS disk

images. If a user or automated system were tricked into mounting a

specially crafted disk image, a remote attacker could use this issue to

cause a denial of service, or possibly execute arbitrary code.

(CVE-2022-30784, CVE-2022-30786, CVE-2022-30788, CVE-2022-30789)

Roman Fiedler discovered that NTFS-3G incorrectly h...

Read the Full Advisory

Topics Covered

security advisory denial of service critical remote code execution Ubuntu ntfs-3g

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  ntfs-3g                         1:2021.8.22-3ubuntu1.1

Ubuntu 21.10:
  ntfs-3g                         1:2017.3.23AR.3-3ubuntu5.1

Ubuntu 20.04 LTS:
  ntfs-3g                         1:2017.3.23AR.3-3ubuntu1.2

Ubuntu 18.04 LTS:
  ntfs-3g                         1:2017.3.23-2ubuntu0.18.04.4

In general, a standard system update will make all the necessary changes.