Input validation error in NTFS-3G - CVE-2022-40284

Vulnerability identifier: #VU68937

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40284

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due in libntfs-3g/runlist.c to application incorrectly validates certain NTFS metadata, related to zero-sized runs. A local user can abuse application behavior to escalate privileges on the system.

NTFS-3G
Oracle Linux
Debian Linux
Fedora
Red Hat CodeReady Linux Builder for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Workstation Extension
Slackware Linux
Ubuntu
openSUSE Leap
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
ntfs-3g (Ubuntu package)
netcf-libs
netcf-devel
netcf
swtpm
swtpm-devel
swtpm-libs
swtpm-tools
swtpm-tools-pkcs11
libtpms
libtpms-devel
sgabios-bin
sgabios
libvirt-dbus
hivex-devel
ruby-hivex
ocaml-hivex
ocaml-hivex-devel
hivex
perl-hivex
python3-hivex
python3-libnbd
ocaml-libnbd-devel
ocaml-libnbd
libnbd-devel
libnbd
libnbd-bash-completion
nbdfuse
seabios
seavgabios-bin
seabios-bin
libiscsi
libiscsi-devel
libiscsi-utils
nbdkit-ssh-plugin
nbdkit-gzip-plugin
nbdkit-linuxdisk-plugin
nbdkit-gzip-filter
nbdkit-nbd-plugin
nbdkit-python-plugin
nbdkit-server
nbdkit-xz-filter
nbdkit
nbdkit-basic-filters
nbdkit-basic-plugins
nbdkit-curl-plugin
nbdkit-devel
nbdkit-tar-filter
nbdkit-tar-plugin
nbdkit-example-plugins
nbdkit-tmpdisk-plugin
nbdkit-vddk-plugin
nbdkit-bash-completion
libguestfs-man-pages-ja
virt-dib
ruby-libguestfs
lua-guestfs
libguestfs-bash-completion
ocaml-libguestfs
ocaml-libguestfs-devel
libguestfs-inspect-icons
libguestfs-javadoc
perl-Sys-Guestfs
libguestfs
libguestfs-appliance
libguestfs-rescue
libguestfs-tools-c
libguestfs-xfs
libguestfs-rsync
python3-libguestfs
libguestfs-java-devel
libguestfs-java
libguestfs-gobject-devel
libguestfs-gobject
libguestfs-gfs2
libguestfs-tools
libguestfs-man-pages-uk
libguestfs-devel
supermin
supermin-devel
qemu-user-static
qemu-kvm-ui-spice
qemu-kvm-ui-opengl
qemu-kvm-hw-usbredir
qemu-kvm
qemu-kvm-block-gluster
qemu-kvm-tests
qemu-kvm-docs
qemu-kvm-core
qemu-kvm-common
qemu-kvm-block-ssh
qemu-kvm-block-rbd
qemu-kvm-block-iscsi
qemu-kvm-block-curl
qemu-guest-agent
qemu-img
perl-Sys-Virt
python3-libvirt
libvirt-daemon-kvm
libvirt-nss
libvirt
libvirt-client
libvirt-daemon
libvirt-daemon-config-network
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-interface
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-qemu
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage-gluster
libvirt-lock-sanlock
libvirt-libs
libvirt-docs
libvirt-devel
libvirt-wireshark
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-disk
libguestfs-winsupport
libguestfs-winsupport (Red Hat package)
ntfs-3g (Debian package)
ntfs-3g-help
ntfs-3g
ntfs-3g-debugsource
ntfs-3g-debuginfo
ntfs-3g-devel
libntfs-3g84
libntfs-3g84-debuginfo
ntfs-3g_ntfsprogs-debugsource
ntfsprogs
ntfsprogs-debuginfo
libntfs-3g-devel
libntfs-3g87-debuginfo
libntfs-3g87
ntfs-3g_ntfsprogs-debuginfo
ntfsprogs-extra
ntfsprogs-extra-debuginfo

Install updates from vendor's website.

NTFS-3G - update to 2022.10.3
ntfs-3g (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2017.3.23AR.3-3ubuntu1.3, 1:2017.3.23-2ubuntu0.18.04.5, 1:2021.8.22-3ubuntu1.2, 1:2022.5.17-1ubuntu1.1
netcf-libs - update to 0.2.8-12
netcf-devel - update to 0.2.8-12
netcf - update to 0.2.8-12
swtpm - update to 0.7.0-4.20211109gitb79fd91
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
libtpms - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms-devel - update to 0.9.1-2.20211126git1ff6fe1f43
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
hivex-devel - update to 1.3.18-23
ruby-hivex - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
python3-hivex - update to 1.3.18-23
python3-libnbd - update to 1.6.0-5.0.1
ocaml-libnbd-devel - update to 1.6.0-5.0.1
ocaml-libnbd - update to 1.6.0-5.0.1
libnbd-devel - update to 1.6.0-5.0.1
libnbd - update to 1.6.0-5.0.1
libnbd-bash-completion - update to 1.6.0-5.0.1
nbdfuse - update to 1.6.0-5.0.1
seabios - update to 1.16.0-4
seavgabios-bin - update to 1.16.0-4
seabios-bin - update to 1.16.0-4
libiscsi - update to 1.18.0-8.0.1
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi-utils - update to 1.18.0-8.0.1
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
nbdkit-bash-completion - update to 1.24.0-5
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
libguestfs-tools-c - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
python3-libguestfs - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
libguestfs-java - update to 1.44.0-9.0.1
libguestfs-gobject-devel - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
supermin - update to 5.2.1-2.0.2
supermin-devel - update to 5.2.1-2.0.2
qemu-user-static - update to 6.2.0-33.0.2
qemu-kvm-ui-spice - update to 6.2.0-33.0.2
qemu-kvm-ui-opengl - update to 6.2.0-33.0.2
qemu-kvm-hw-usbredir - update to 6.2.0-33.0.2
qemu-kvm - update to 6.2.0-33.0.2
qemu-kvm-block-gluster - update to 6.2.0-33.0.2
qemu-kvm-tests - update to 6.2.0-33.0.2
qemu-kvm-docs - update to 6.2.0-33.0.2
qemu-kvm-core - update to 6.2.0-33.0.2
qemu-kvm-common - update to 6.2.0-33.0.2
qemu-kvm-block-ssh - update to 6.2.0-33.0.2
qemu-kvm-block-rbd - update to 6.2.0-33.0.2
qemu-kvm-block-iscsi - update to 6.2.0-33.0.2
qemu-kvm-block-curl - update to 6.2.0-33.0.2
qemu-guest-agent - update to 6.2.0-33.0.2
qemu-img - update to 6.2.0-33.0.2
perl-Sys-Virt - update to 8.0.0-1
python3-libvirt - update to 8.0.0-2
libvirt-daemon-kvm - update to 8.0.0-21
libvirt-nss - update to 8.0.0-21
libvirt - update to 8.0.0-21
libvirt-client - update to 8.0.0-21
libvirt-daemon - update to 8.0.0-21
libvirt-daemon-config-network - update to 8.0.0-21
libvirt-daemon-config-nwfilter - update to 8.0.0-21
libvirt-daemon-driver-interface - update to 8.0.0-21
libvirt-daemon-driver-network - update to 8.0.0-21
libvirt-daemon-driver-nodedev - update to 8.0.0-21
libvirt-daemon-driver-nwfilter - update to 8.0.0-21
libvirt-daemon-driver-qemu - update to 8.0.0-21
libvirt-daemon-driver-secret - update to 8.0.0-21
libvirt-daemon-driver-storage - update to 8.0.0-21
libvirt-daemon-driver-storage-core - update to 8.0.0-21
libvirt-daemon-driver-storage-gluster - update to 8.0.0-21
libvirt-lock-sanlock - update to 8.0.0-21
libvirt-libs - update to 8.0.0-21
libvirt-docs - update to 8.0.0-21
libvirt-devel - update to 8.0.0-21
libvirt-wireshark - update to 8.0.0-21
libvirt-daemon-driver-storage-scsi - update to 8.0.0-21
libvirt-daemon-driver-storage-rbd - update to 8.0.0-21
libvirt-daemon-driver-storage-mpath - update to 8.0.0-21
libvirt-daemon-driver-storage-logical - update to 8.0.0-21
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-21
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-21
libvirt-daemon-driver-storage-disk - update to 8.0.0-21
libguestfs-winsupport - update to 8.8-2
libguestfs-winsupport (Red Hat package) - addressed in versions 9.0-2.el9_0, 9.2-2.el9_2
ntfs-3g (Debian package) - update to 1:2017.3.23AR.3-4+deb11u3
ntfs-3g-help - update to 2022.5.17-2
ntfs-3g - update to 2022.5.17-2
ntfs-3g-debugsource - update to 2022.5.17-2
ntfs-3g-debuginfo - update to 2022.5.17-2
ntfs-3g-devel - update to 2022.5.17-2
libntfs-3g84 - update to 2022.5.17-5.17.1
libntfs-3g84-debuginfo - update to 2022.5.17-5.17.1
ntfs-3g - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
ntfs-3g-debuginfo - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
ntfs-3g_ntfsprogs-debugsource - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
ntfsprogs - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
ntfsprogs-debuginfo - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
libntfs-3g-devel - addressed in versions 2022.5.17-5.17.1, 2022.5.17-150000.3.16.1
libntfs-3g87-debuginfo - update to 2022.5.17-150000.3.16.1
libntfs-3g87 - update to 2022.5.17-150000.3.16.1
ntfs-3g_ntfsprogs-debuginfo - update to 2022.5.17-150000.3.16.1
ntfsprogs-extra - update to 2022.5.17-150000.3.16.1
ntfsprogs-extra-debuginfo - update to 2022.5.17-150000.3.16.1
ntfs-3g - update to 2022.10.3
ntfs-3g - addressed in versions 2022.10.3-1.el7, 2022.10.3-1.el8, 2022.10.3-1.el9, 2022.10.3-1.fc35, 2022.10.3-1.fc36, 2022.10.3-1.fc37

• https://github.com/tuxera/ntfs-3g/commit/18bfc676119a1188e8135287b8327b0760ba44a1
• https://github.com/tuxera/ntfs-3g/commit/76c3a799a97fbcedeeeca57f598be508ae2a1656
• https://www.openwall.com/lists/oss-security/2022/10/31/2

• Privilege escalation in Tuxera NTFS-3G
• Ubuntu update for ntfs-3g
• Ubuntu update for ntfs-3g
• SUSE update for ntfs-3g_ntfsprogs
• SUSE update for ntfs-3g_ntfsprogs
• Debian update for ntfs-3g
• Slackware Linux update for ntfs-3g
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for the virt:rhel and virt-devel:rhel modules
• Red Hat Enterprise Linux 8 update for the virt:rhel module
• Red Hat Enterprise Linux 8 update for the virt:rhel module
• Red Hat Enterprise Linux 9.0 Extended Update Support update for libguestfs-winsupport
• Red Hat Enterprise Linux 9 update for libguestfs-winsupport
• Multiple vulnerabilities in Oracle Linux
• openEuler update for ntfs-3g
• Fedora EPEL 8 update for ntfs-3g
• Fedora EPEL 9 update for ntfs-3g
• Fedora 35 update for ntfs-3g
• Fedora EPEL 7 update for ntfs-3g
• Fedora 36 update for ntfs-3g
• Fedora 37 update for ntfs-3g
• Anolis OS update for virt:an module