7.8

CVE-2021-33285

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tuxera ≫ Ntfs-3g Version < 2021.8.22
Redhat ≫ Enterprise Linux Version 7.0
Redhat ≫ Enterprise Linux Version 8.0 SwEdition -
Redhat ≫ Enterprise Linux Version 8.0 SwEdition advanced_virtualization
Fedoraproject ≫ Fedora Version 33
Fedoraproject ≫ Fedora Version 34
Fedoraproject ≫ Fedora Version 35
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.334
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CISA-ADP 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2021/08/30/1
Third Party Advisory
Mailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386
Third Party Advisory
Mailing List
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2001608
Third Party Advisory
Issue Tracking
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/
https://security.gentoo.org/glsa/202301-01
Third Party Advisory
https://www.debian.org/security/2021/dsa-4971
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/08/30/1
Third Party Advisory
Mailing List