Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
From https://www.openwall.com/lists/oss-security/2021/08/30/1:
Security vulnerabilities were identified in the open source NTFS-3G and NTFSPROGS software. These vulnerabilities were confirmed and resolved. To our knowledge, these vulnerabilities have not been exploited.
These vulnerabilities may allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to potentially execute arbitrary privileged code, if the attacker has either local access and the ntfs-3g binary is setuid root, or if the attacker has physical access to an external port to a computer which is configured to run the ntfs-3g binary or one of the ntfsprogs tools when the external storage is plugged into the computer. These vulnerabilities result from incorrect validation of some of the NTFS metadata that could potentially cause buffer overflows, which could be exploited by an attacker. Common ways for attackers to gain physical access to a machine is through social engineering or an evil maid attack on an unattended computer.
We recommend installing and applying the update with the security fixes, and advise to follow security guidance and frameworks such as NIST for assessing and improving an organization’s abilities to prevent, detect, and respond to security threats and cyber attacks.
AFFECTED PRODUCTS: All previous versions of open source NTFS-3G and NTFSPROGS.
WORKAROUND: None
SOLUTION: Upgrade to 2021.8.22
PROJECT URL: https://github.com/tuxera/ntfs-3g
ADVISORY ID: NTFS3G-SA-2021-0001
ISSUE DATE: 2021-08-30
SEVERITY: Moderate
CVEs: CVE-2021-33285, CVE-2021-35269, CVE-2021-35268, CVE-2021-33289, CVE-2021-33286, CVE-2021-35266, CVE-2021-33287, CVE-2021-35267, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263
CVSS SCORE: 3.9-6.7
ACKNOWLEDGMENT: Jeremy Galindo, Akshay Ajayan, Kyle Zeng and Fish Wang for reporting these vulnerabilities.
ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+5123-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
A crafted NTFS image can cause heap exhaustion in ntfsgetattributevalue in NTFS-3G through 2021.8.22.
A crafted NTFS image can cause a heap-based buffer overflow in ntfsnamesfullcollate in NTFS-3G through 2021.8.22.
A crafted NTFS image can cause a heap-based buffer overflow in ntfsmftrecalloc in NTFS-3G through 2021.8.22.
A crafted NTFS image can cause a heap-based buffer overflow in ntfschecklogclientarray in NTFS-3G through 2021.8.22.
A file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
A heap-based buffer overflow was discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation.
Reference: https://security-tracker.debian.org/tracker/source-package/ntfs-3g
An invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.
An integer underflow in fuselibreaddir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
Description of problem: Fuse in general and Fedora's way to let only members of the group fuse access and use fuse was discussed in https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html and mails below in that thread.
There we noticed that members of the group fuse can get access to devices which they normally should not have access to. See https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html ; the relevant parts of it:
$ ls -l /dev/sda3 brw-r----- 1 root disk 8, 3 14. Sep 16:10 /dev/sda3 $ groups thl fuse $ dd if=/dev/sda3 bs=512K count=1 | strings dd: opening /dev/sda3': Permission denied $ mkdir ntfs $ /sbin/mount.ntfs-3g /dev/sda3 ntfs/ $ touch ntfs/foo $ ls -l ntfs/foo -rwxrwxrwx 1 thl thl 0 18. Sep 19:27 ntfs/foo
ntfs-3g IMHO should fail, as the users should not get access to random devices he has no access to. Quoting Alexander Larsson from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00171.html
Thats quite weird. The way I undestand fuse is that you run the filesystem as your user, and then that filesystem (via libfuse) spawns fusermount to open the fuse device and attach to the mountpoint. fusermount then passes the fd to the fuse device back the the filesystem process (via a socket) which then handles all the requests. Reading the data source for the filesystem (if there is any) is only done by the filesystem process, not by the setuid fusermount helper, so it should not be able to read /dev/sda3.
Further investigation showed that ntfs-3g gets installed SUID root:
$ ls -l /sbin/mount.ntfs-3g -rwsr-xr-- 1 root fuse 40528 17. Sep 23:14 /sbin/mount.ntfs-3g
That might be wrong as that afaics makes it possible for ntfs-3g to access devices which the user normally would not have access to. Quoting Alexander again, this time from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00174.html
Oh. That seems like a bad idea to me. If this drops privs after opening the device I think you can attach to the process using e.g. gdb and call any read() operation on the device. If might even mean (with some creative exploits) that any fuse group user can read any block on any disk.
Version-Release number of selected component (if applicable): ntfs-3g-1.913-1.fc8
Please note that I as ex-maintainer of fuse stumbled into this by accident -- I don't care much about fuse and ntfs-3g these days, but I think the behavior of ntfs-3g is a security bug.
A heap-based buffer overflow was discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation.
Reference: https://security-tracker.debian.org/tracker/source-package/ntfs-3g