CVE-2021-33287
📋 TL;DR
A heap buffer overflow vulnerability in NTFS-3G allows attackers to write to arbitrary memory or cause denial of service when reading specially crafted NTFS attributes. This affects systems using NTFS-3G to access NTFS filesystems, particularly Linux/Unix systems mounting Windows drives. The vulnerability requires access to mount or process malicious NTFS filesystems.
💻 Affected Systems
- NTFS-3G
- Tuxera NTFS-3G
- Linux distributions with NTFS-3G packages
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ntfs 3g by Tuxera
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution with the privileges of the user or process accessing the NTFS filesystem, potentially leading to full system compromise.
Likely Case
Application crash or denial of service when processing malicious NTFS filesystems, with potential for limited memory corruption.
If Mitigated
No impact if systems don't mount untrusted NTFS filesystems or have updated NTFS-3G.
🎯 Exploit Status
Exploitation requires the attacker to provide a malicious NTFS filesystem that the victim mounts. Proof of concept code is publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.8.22 and later
Vendor Advisory: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
Restart Required: No
Instructions:
1. Update NTFS-3G to version 2021.8.22 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install ntfs-3g. 3. For RHEL/CentOS: sudo yum update ntfs-3g. 4. For source installations: Download from http://ntfs-3g.com and compile/install.
🔧 Temporary Workarounds
Disable automatic NTFS mounting
linuxPrevent automatic mounting of NTFS filesystems to block attack vectors
sudo systemctl mask udisks2
sudo umount /dev/sdX1 (for specific NTFS drives)
Edit /etc/fstab to remove NTFS entries
Mount NTFS as read-only
linuxMount NTFS filesystems with read-only permissions to limit damage
sudo mount -t ntfs-3g -o ro /dev/sdX1 /mnt/ntfs
🧯 If You Can't Patch
- Restrict access to mount NTFS filesystems to trusted users only
- Implement strict controls on external media and network shares containing NTFS filesystems
🔍 How to Verify
Check if Vulnerable:
Check NTFS-3G version: ntfs-3g --version | head -1Check Version:
ntfs-3g --version | head -1Verify Fix Applied:
Verify version is 2021.8.22 or higher: ntfs-3g --version | grep -q '2021.8.22\|2021.8.23\|2021.8.24\|2021.9\|2021.10\|2021.11\|2021.12\|2022' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing NTFS-3G crashes
- System logs with segmentation faults in ntfs-3g processes
- Unexpected mount/unmount events of NTFS filesystems
Network Indicators:
- Unusual SMB/CIFS connections preceding NTFS mount events
- External media insertion logs followed by system instability
SIEM Query:
process_name:"ntfs-3g" AND (event_type:"crash" OR exit_code:139) OR (source:"/var/log/syslog" AND "ntfs-3g" AND "segmentation fault")🔗 References
- http://ntfs-3g.com
- http://tuxera.com
- http://www.openwall.com/lists/oss-security/2021/08/30/1
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
- https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2021/dsa-4971
- http://ntfs-3g.com
- http://tuxera.com
- http://www.openwall.com/lists/oss-security/2021/08/30/1
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
- https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2021/dsa-4971
