CVE-2017-0358: ntfs-3g: Modprobe influence vulnerability via environment variables
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0358?
CVE-2017-0358 is considered a critical vulnerability due to its potential for local root privilege escalation.
How do I fix CVE-2017-0358?
To mitigate CVE-2017-0358, update the ntfs-3g package to a version that includes the security fix.
Who discovered CVE-2017-0358?
CVE-2017-0358 was discovered by Jann Horn from Google Project Zero.
Which systems are affected by CVE-2017-0358?
CVE-2017-0358 affects systems using the ntfs-3g driver, particularly those on Debian Linux and specific versions of ntfs-3g.
What type of vulnerability is CVE-2017-0358?
CVE-2017-0358 is a local privilege escalation vulnerability that allows local users to gain elevated privileges.