CVE-2021-33285
📋 TL;DR
A heap buffer overflow vulnerability in NTFS-3G allows memory disclosure or denial of service when mounting a specially crafted NTFS partition. Attackers can exploit this by tricking users into mounting malicious drives or accessing crafted filesystems. Systems using NTFS-3G for NTFS filesystem access are affected.
💻 Affected Systems
- NTFS-3G
- Tuxera NTFS-3G
- libntfs-3g
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Ntfs 3g by Tuxera
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise if combined with other vulnerabilities, though this requires specific memory layout conditions.
Likely Case
Denial of service (system crash) or memory disclosure (sensitive information leakage) when mounting malicious NTFS partitions.
If Mitigated
Limited impact with proper mount restrictions and user privilege separation.
🎯 Exploit Status
Exploitation requires the ability to mount a crafted NTFS filesystem, which typically requires local access or social engineering. Proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.8.22 and later
Vendor Advisory: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
Restart Required: No
Instructions:
1. Update NTFS-3G to version 2021.8.22 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install ntfs-3g. 3. For RHEL/CentOS: sudo yum update ntfs-3g. 4. For source installations: Download latest from https://www.tuxera.com/community/open-source-ntfs-3g/ and recompile.
🔧 Temporary Workarounds
Restrict NTFS mounting
linuxLimit who can mount NTFS filesystems using mount permissions and user/group restrictions.
sudo chmod 700 /bin/mount
sudo chown root:root /bin/mount
Configure /etc/fstab with 'noauto' and 'user' options appropriately
Disable NTFS-3G if unused
linuxRemove or disable NTFS-3G if NTFS filesystem support is not required.
sudo apt remove ntfs-3g
sudo yum remove ntfs-3g
🧯 If You Can't Patch
- Implement strict mount policies: Only allow trusted users to mount filesystems and restrict mount sources to trusted locations.
- Use application whitelisting to prevent execution of NTFS-3G binaries by untrusted users.
🔍 How to Verify
Check if Vulnerable:
Check NTFS-3G version: ntfs-3g --version | head -1. If version is earlier than 2021.8.22, system is vulnerable.Check Version:
ntfs-3g --version | head -1Verify Fix Applied:
After update, verify version is 2021.8.22 or later: ntfs-3g --version | grep -q '2021.8.22' && echo 'Patched' || echo 'Still vulnerable'📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing filesystem corruption or crashes when mounting NTFS
- System logs with segmentation faults in ntfs-3g processes
- Unexpected mount operations of NTFS filesystems
Network Indicators:
- Unusual SMB/NFS mounts preceding NTFS mount operations
- Network transfers of suspicious disk images
SIEM Query:
process_name='mount' AND command_line LIKE '%ntfs%' AND NOT user IN (trusted_users_list)🔗 References
- http://www.openwall.com/lists/oss-security/2021/08/30/1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386
- https://bugzilla.redhat.com/show_bug.cgi?id=2001608
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
- https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2021/dsa-4971
- https://www.openwall.com/lists/oss-security/2021/08/30/1
- http://www.openwall.com/lists/oss-security/2021/08/30/1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386
- https://bugzilla.redhat.com/show_bug.cgi?id=2001608
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
- https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2021/dsa-4971
- https://www.openwall.com/lists/oss-security/2021/08/30/1
