CVE-2022-30784
📋 TL;DR
This vulnerability in NTFS-3G allows a specially crafted NTFS filesystem image to trigger heap exhaustion via the ntfs_get_attribute_value function, potentially causing denial of service. Systems using NTFS-3G to mount or access NTFS filesystems are affected, particularly Linux/Unix systems that need NTFS compatibility.
💻 Affected Systems
- NTFS-3G
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ntfs 3g by Tuxera
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or unavailability due to heap exhaustion, potentially requiring reboot and causing data loss or corruption.
Likely Case
Application or service crash when processing malicious NTFS images, leading to temporary denial of service for affected processes.
If Mitigated
Limited impact with proper access controls preventing untrusted NTFS images from being mounted.
🎯 Exploit Status
Exploitation requires mounting a malicious NTFS image, which typically requires some level of access or user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.8.23 and later
Vendor Advisory: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
Restart Required: No
Instructions:
1. Update NTFS-3G package using system package manager. 2. For Linux: 'sudo apt update && sudo apt upgrade ntfs-3g' (Debian/Ubuntu) or 'sudo yum update ntfs-3g' (RHEL/CentOS). 3. For source installations: Download latest from GitHub and recompile.
🔧 Temporary Workarounds
Restrict NTFS mounting
linuxPrevent mounting of untrusted NTFS filesystems via permissions or policies.
sudo chmod 700 /bin/mount
sudo chmod 700 /sbin/mount.ntfs-3g
Disable NTFS-3G FUSE module
linuxTemporarily disable NTFS-3G if not needed.
sudo modprobe -r fuse
echo 'blacklist fuse' | sudo tee /etc/modprobe.d/blacklist-fuse.conf
🧯 If You Can't Patch
- Avoid mounting untrusted NTFS filesystems from unknown sources.
- Implement strict access controls on mount utilities and filesystem operations.
🔍 How to Verify
Check if Vulnerable:
Check NTFS-3G version: 'ntfs-3g --version' or 'dpkg -l | grep ntfs-3g' or 'rpm -q ntfs-3g'.Check Version:
ntfs-3g --version | head -1Verify Fix Applied:
Confirm version is 2021.8.23 or higher using version check command.📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing 'out of memory' or process crashes related to mount/ntfs-3g
- System logs with mount failures or filesystem errors
Network Indicators:
- Unusual network file transfers of NTFS images
- SMB/NFS requests for NTFS filesystem mounting
SIEM Query:
Process:name="mount" AND CommandLine:"ntfs" OR Process:name="ntfs-3g" AND EventID:1000 (Application Crash)🔗 References
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
