Description
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.
References (7)
Core 7
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/31/2
Third Party Advisory
https://github.com/tuxera/ntfs-3g/releases
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/11/msg00029.html
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IA2D4PYOR7ABI7BWBMMMYKY2OPHTV2NI/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BOQ7YLFT43KLXEN3EB6CS4DP635RJWP/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGDKGXA4R2ZVUQ3CT4D4YGTFMNZQA7HW/
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202301-01
Scores
CVSS v3
7.8
EPSS
0.0005
EPSS Percentile
15.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-120
Status
published
Products (5)
debian/debian_linux
10.0
fedoraproject/fedora
35
fedoraproject/fedora
36
fedoraproject/fedora
37
tuxera/ntfs-3g
< 2022.10.3
Published
Nov 06, 2022
Tracked Since
Feb 18, 2026