CVE-2022-40284: Buffer Overflow
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntfs-3gto a version that resolves this vulnerability.Fixed in 2022.10.3 - Configuration
Ensure the ntfs-3g binary is not setuid root to prevent local exploitation.
ntfs-3g setuid-root permission on ntfs-3g binary = remove/disable setuid root - Configuration
Disable configuring NTFS-3G to execute on attachment of external storage devices to prevent physically proximate attackers from triggering exploitation via crafted NTFS metadata.
System automount/attachment handling for external storage execute ntfs-3g on device attachment = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40284?
CVE-2022-40284 has a high severity due to its potential to enable code execution through a buffer overflow.
How do I fix CVE-2022-40284?
To fix CVE-2022-40284, update the NTFS-3G software to version 2022.10.3 or later on affected systems.
Who is affected by CVE-2022-40284?
CVE-2022-40284 affects users of NTFS-3G prior to version 2022.10.3, particularly in settings where the binary is setuid root.
Can CVE-2022-40284 be exploited remotely?
CVE-2022-40284 requires local access to exploit, making it less likely to be used in remote attacks.
What is the impact of CVE-2022-40284?
The impact of CVE-2022-40284 includes potential unauthorized code execution, which could compromise system integrity.