CVE-2022-30786
📋 TL;DR
CVE-2022-30786 is a heap-based buffer overflow vulnerability in NTFS-3G's ntfs_names_full_collate function that allows attackers to execute arbitrary code or cause denial of service by mounting a specially crafted NTFS image. This affects systems using NTFS-3G for NTFS filesystem access, particularly Linux/Unix systems that mount NTFS drives. The vulnerability requires local access to mount malicious NTFS images.
💻 Affected Systems
- NTFS-3G
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ntfs 3g by Tuxera
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the user mounting the NTFS image, potentially leading to root access if mounted by privileged users.
Likely Case
Denial of service (system crash) or limited code execution within the context of the mounting user's permissions.
If Mitigated
No impact if systems don't mount untrusted NTFS images or have updated NTFS-3G.
🎯 Exploit Status
Exploitation requires local access to mount a crafted NTFS image. Proof-of-concept code is available in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.8.23 and later
Vendor Advisory: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
Restart Required: No
Instructions:
1. Update NTFS-3G to version 2021.8.23 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install ntfs-3g. 3. For RHEL/CentOS/Fedora: sudo yum update ntfs-3g or sudo dnf update ntfs-3g. 4. For source installations: Download latest from https://github.com/tuxera/ntfs-3g and compile.
🔧 Temporary Workarounds
Disable NTFS mounting
linuxPrevent mounting of NTFS filesystems to eliminate attack surface
sudo rmmod fuse
sudo chmod 000 /sbin/mount.ntfs
sudo chmod 000 /usr/bin/ntfs-3g
Mount NTFS as read-only
linuxMount NTFS filesystems with read-only option to prevent exploitation
mount -t ntfs-3g -o ro /dev/sdX1 /mnt/ntfs
🧯 If You Can't Patch
- Restrict NTFS mounting to trusted users only via sudoers or similar access controls
- Implement strict controls on what NTFS images can be mounted (whitelist trusted sources only)
🔍 How to Verify
Check if Vulnerable:
Check NTFS-3G version: ntfs-3g --version | head -1. If version is 2021.8.22 or earlier, system is vulnerable.Check Version:
ntfs-3g --version | head -1Verify Fix Applied:
After update, verify version is 2021.8.23 or later: ntfs-3g --version | head -1📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing NTFS-3G crashes
- System logs with mount failures for NTFS filesystems
- Unexpected process termination of mount.ntfs or ntfs-3g
Network Indicators:
- No network indicators - this is a local filesystem vulnerability
SIEM Query:
Process termination: (process_name="mount.ntfs" OR process_name="ntfs-3g") AND termination_type="crash"🔗 References
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
